Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
Analysis ID:1532785
MD5:647a2177841aebe2f1bb1b3767f41287
SHA1:446575615e7fcc9c58fb04cad12909a183a2eb15
SHA256:07c1abb57c4498748c4f1344a786c2c136b82651786ed005d999ecbf6054fb2c
Tags:exe
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:49
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Contain functionality to detect virtual machines
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to infect the boot sector
Creates an undocumented autostart registry key
Found direct / indirect Syscall (likely to bypass EDR)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Changes image file execution options
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to detect virtual machines (SLDT)
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Disables exception chain validation (SEHOP)
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Enables driver privileges
Enables security privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file contains strange resources
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Uses net.exe to stop services
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
query blbeacon for getting browser version

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe (PID: 6316 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe" MD5: 647A2177841AEBE2F1BB1B3767F41287)
    • SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp (PID: 6292 cmdline: "C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp" /SL5="$402A0,29027361,780800,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe" MD5: 2C94C19646786C4EE5283B02FD8CE5A5)
      • saBSI.exe (PID: 5924 cmdline: "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US MD5: 143255618462A577DE27286A272584E1)
      • avg_antivirus_free_setup.exe (PID: 2160 cmdline: "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg MD5: 26816AF65F2A3F1C61FB44C682510C97)
        • avg_antivirus_free_online_setup.exe (PID: 5688 cmdline: "C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /ga_clientid:b9592fc5-5741-4a25-98a5-ccd83d3c903a /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec MD5: 4DE05BCEF050AB8FA30941A9E3454645)
          • icarus.exe (PID: 6504 cmdline: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml /install /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a MD5: B178E9C05511563BDF3A5097D9116197)
      • norton_secure_browser_setup.exe (PID: 5428 cmdline: "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe" /s /make-default /run_source="norton_ppi_is" MD5: F269C5140CBC0E376CC7354A801DDD16)
        • NortonBrowserUpdateSetup.exe (PID: 6904 cmdline: NortonBrowserUpdateSetup.exe /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" MD5: 2B07E26D3C33CD96FA825695823BBFA7)
          • NortonBrowserUpdate.exe (PID: 6212 cmdline: "C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe" /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" MD5: BF8FE62DBCD949547AF37EEE4ECE61FC)
            • NortonBrowserUpdate.exe (PID: 1220 cmdline: "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regsvc MD5: BF8FE62DBCD949547AF37EEE4ECE61FC)
            • NortonBrowserUpdate.exe (PID: 5856 cmdline: "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regserver MD5: BF8FE62DBCD949547AF37EEE4ECE61FC)
      • CheatEngine75.exe (PID: 5808 cmdline: "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST MD5: E0F666FE4FF537FB8587CCD215E41E5F)
        • CheatEngine75.tmp (PID: 2504 cmdline: "C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp" /SL5="$90282,26511452,832512,C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST MD5: 9AA2ACD4C96F8BA03BB6C3EA806D806F)
          • net.exe (PID: 1704 cmdline: "net" stop BadlionAntic MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
            • conhost.exe (PID: 4564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • net1.exe (PID: 1068 cmdline: C:\Windows\system32\net1 stop BadlionAntic MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
          • net.exe (PID: 3616 cmdline: "net" stop BadlionAnticheat MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
            • conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • net1.exe (PID: 928 cmdline: C:\Windows\system32\net1 stop BadlionAnticheat MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
          • sc.exe (PID: 3396 cmdline: "sc" delete BadlionAntic MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
            • conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • sc.exe (PID: 1016 cmdline: "sc" delete BadlionAnticheat MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
            • conhost.exe (PID: 4124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • _setup64.tmp (PID: 6448 cmdline: helper 105 0x42C MD5: E4211D6D009757C078A9FAC7FF4F03D4)
            • conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • icacls.exe (PID: 6616 cmdline: "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX) MD5: 48C87E3B3003A2413D6399EA77707F5D)
            • conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • Kernelmoduleunloader.exe (PID: 7120 cmdline: "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP MD5: 9AF96706762298CF72DF2A74213494C9)
          • windowsrepair.exe (PID: 2668 cmdline: "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s MD5: 9A4D1B5154194EA0C42EFEBEB73F318F)
          • icacls.exe (PID: 1988 cmdline: "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX) MD5: 48C87E3B3003A2413D6399EA77707F5D)
            • conhost.exe (PID: 5368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Cheat Engine.exe (PID: 2688 cmdline: "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe" MD5: F921416197C2AE407D53BA5712C3930A)
        • cheatengine-x86_64-SSE4-AVX2.exe (PID: 4852 cmdline: "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe" MD5: 910DE25BD63B5DA521FC0B598920C4EC)
      • WerFault.exe (PID: 4476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 972 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 1720 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 1068 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6292 -ip 6292 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • NortonBrowserUpdate.exe (PID: 3336 cmdline: "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /c MD5: BF8FE62DBCD949547AF37EEE4ECE61FC)
  • NortonBrowserUpdate.exe (PID: 5472 cmdline: "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /ua /installsource scheduler MD5: BF8FE62DBCD949547AF37EEE4ECE61FC)
    • NortonBrowserUpdate.exe (PID: 6012 cmdline: "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /registermsihelper MD5: BF8FE62DBCD949547AF37EEE4ECE61FC)
    • NortonBrowserUpdate.exe (PID: 5576 cmdline: "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /uninstall MD5: BF8FE62DBCD949547AF37EEE4ECE61FC)
  • msiexec.exe (PID: 6716 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files (x86)\GUT98FF.tmpPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x1f88a8:$Dwork: D:\work
  • 0x1fac58:$Dwork: D:\work
  • 0x1faedc:$Dwork: D:\work
  • 0x2019f8:$Dwork: D:\work
  • 0x201ba0:$Dwork: D:\work
  • 0x201d08:$Dwork: D:\work
  • 0x201de0:$Dwork: D:\work
  • 0x202040:$Dwork: D:\work
  • 0x202160:$Dwork: D:\work
  • 0x202280:$Dwork: D:\work
  • 0x202330:$Dwork: D:\work
  • 0x2db910:$Dwork: D:\work
  • 0x2dba38:$Dwork: D:\work
  • 0x2dbba0:$Dwork: D:\work
  • 0x2dbd88:$Dwork: D:\work
  • 0x2dbe78:$Dwork: D:\work
  • 0x2dbff8:$Dwork: D:\work
  • 0x2dc118:$Dwork: D:\work
  • 0x2dc1c8:$Dwork: D:\work
  • 0x4ed054:$Dwork: D:\work
  • 0x4ed0b0:$Dwork: D:\work

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: NortonBrowserUpdateComRegisterShell64.exe PID: 3896PlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x39da:$Dwork: D:\work
  • 0x4cba:$Shell6: Shell6
  • 0x4ced:$Shell6: Shell6

Sigma Signatures

System Summary

barindex
Sigma detected: Net.exe Execution
Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "net" stop BadlionAntic, CommandLine: "net" stop BadlionAntic, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp" /SL5="$90282,26511452,832512,C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST, ParentImage: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp, ParentProcessId: 2504, ParentProcessName: CheatEngine75.tmp, ProcessCommandLine: "net" stop BadlionAntic, ProcessId: 1704, ProcessName: net.exe
Sigma detected: Stop Windows Service Via Net.EXE
Source: Process startedAuthor: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: "net" stop BadlionAntic, CommandLine: "net" stop BadlionAntic, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp" /SL5="$90282,26511452,832512,C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST, ParentImage: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp, ParentProcessId: 2504, ParentProcessName: CheatEngine75.tmp, ProcessCommandLine: "net" stop BadlionAntic, ProcessId: 1704, ProcessName: net.exe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 1720, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002C14F0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CryptMsgGetParam,CertFreeCRLContext,CertFreeCRLContext,5_2_002C14F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002C17A0 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptQueryObject,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,5_2_002C17A0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00275870 GetCurrentProcessId,GetCurrentThreadId,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,UuidCreate,UuidCreate,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,5_2_00275870
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00276220 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,5_2_00276220
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AE610 CryptMsgClose,5_2_002AE610
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002767B0 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,5_2_002767B0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AEB60 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptQueryObject,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,5_2_002AEB60
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AF150 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertFreeCRLContext,5_2_002AF150
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AF3C0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertGetNameStringW,CertGetNameStringW,CertGetCertificateChain,CertFreeCertificateChain,CertFreeCertificateChain,CertVerifyCertificateChainPolicy,CertFreeCertificateChain,CertFreeCRLContext,CertFreeCRLContext,5_2_002AF3C0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A5B0E0 CryptDestroyHash,CryptDestroyHash,6_2_00A5B0E0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A582F0 CryptDestroyHash,6_2_00A582F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A59250 CryptGenRandom,GetLastError,__CxxThrowException@8,6_2_00A59250
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A59450 CryptCreateHash,CryptDestroyHash,GetLastError,__CxxThrowException@8,6_2_00A59450
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A58DC0 lstrcatA,CryptAcquireContextA,CryptReleaseContext,GetLastError,__CxxThrowException@8,CryptReleaseContext,6_2_00A58DC0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A59020 CryptCreateHash,CryptDestroyHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,6_2_00A59020
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A58260 CryptDestroyHash,6_2_00A58260
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A59340 CryptGetHashParam,CryptGetHashParam,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,6_2_00A59340
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A594D0 CryptHashData,GetLastError,__CxxThrowException@8,6_2_00A594D0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A58EF0 CryptReleaseContext,6_2_00A58EF0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A72660 CryptReleaseContext,6_2_00A72660
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B04617F LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,7_2_6B04617F
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_0d947b04-c

Compliance

barindex
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Creates a directory in C:\Program Files
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDirectory created: C:\Program Files\Norton\Browser\NortonBrowserUninstall.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\unins000.dat
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-LB5OD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-MTART.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-0G0TM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-9T5NT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-K6MH5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-2RDUM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-QJSEK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3MBRG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4H3E6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32\is-AOM6Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64\is-0BCA6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32\is-0OS4A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64\is-7TPL7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32\is-5JTH0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64\is-75A04.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-HME12.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3C6G0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-VBUE0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-24I47.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-298KH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-7Q5CB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-HRQ2J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4D2E6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3KOLE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-Q7DRT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-RBU7H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-NPNPQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-RJ6EI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-MQ1KH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-S8B9H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-NBC6R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-70BUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-IJQFS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-DBQ9C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-50KP0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4HAOD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-78OBP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-8G2RP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-Q6VO1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-5922L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib\is-S6F9T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-4J19G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-QKIFN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-8Q4O2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-8SLG2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-F0SFA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-OR7FQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-I5F7F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-JMH80.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-JJBTV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-44CC1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-B5TJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-OL6VE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-CLTQ6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-V5VS4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-JP1J3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-BR785.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-SUSSO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-70FRS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-2KOGR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-IOSNS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-SDMIC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-PLNB1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-4Q1BH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-O9Q8C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-9U0RQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-K8SDA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-HKILU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-6J8NC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-R00DR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-7NEAF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-GNGMP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-QJL6L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-B5EH7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-BR3E9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-N738R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-CIURU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-KJV2L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-04N8G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-9VBQS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-H4510.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-3C6IU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-I08CQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-Q7RFI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-U7L3I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-SM06P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7HMJ2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-Q48TO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7UOLD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-S1JMU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-MR0MU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-EI6G4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-G03C8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-FDRG6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-OR2O6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-C3O5E.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-BT11S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-43AJ9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\is-FLJQJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-K79GF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-D83K0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-TKIKU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-VK45T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-GC3NU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-VCH4D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-OJ9TU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-2FR5R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-GK3MK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\tcc
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\tcc\is-M6HOQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-2AHB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-4KLA5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-R2FR8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-HCTR0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-NDQCS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-3D26K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-1NE8J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-VRBOM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-2DD8C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-C72J0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-S8QLD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-MDU3L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-RVEM5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-426B0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-B7SCC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-LTHHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-ME631.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-6MAEC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-I3SCB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3DASC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-5R3FO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-L3N0T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-TPR80.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-UP51K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-U75H1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-IRTAB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-L1763.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-AKV35.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-9FVFL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-PJLMD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-O5I1D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-1DA6M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-UHV8B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-IDTKR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-TT78L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-QONLV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-AVJBR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-CFLPE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-2D1UK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-DA6UQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-8TGUU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-GCVRT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-692Q1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-VKJIS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-2JPQC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-NUSO1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3265L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4F380.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-D42AS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-PIADI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-2GQ07.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-5AJNR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BKNH7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-V0207.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-ECJSG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-78908.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-L1524.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-6TLNO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-M1718.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-T0R2S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-SUR6B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-ONEVU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-FFQ95.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-2D45H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-A7KQL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-Q3C8H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\images
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-1DU32.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-3VEHV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BOTFQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-TSV58.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BH2HL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-UU2LT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-5NNAH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BQADR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-ANDBM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-CEL34.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-OA13J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-89VU3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-UTFRU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-K2KFB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-9KS7N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-C9ULO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-VGT14.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-8KNKB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-4FINL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-47GOH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-KFVE1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-R7BFR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-4RT86.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-LO9E6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-H6F9C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-NK13K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-KJ922.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-JS32G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-MN8DU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-5RRLD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\is-0OU20.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\xml
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\xml\is-GNT57.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs32
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs32\is-B30AF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs64
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs64\is-K8UEV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-Q14OP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-4PQA1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-QRS1L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-LGQU1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-OTCB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\is-ALU8P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-2M6AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-67UKC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-7TGHP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-NCBT5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-665F7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-LM17N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-SLVPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-U836T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-1QHF1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-KRIHR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-HR134.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\is-O6V9Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-D49SI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-NO8GF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-R0Q39.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-DQKDK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-ARBUH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-S2D5C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-KGL2P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-BIDU2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-CG8FN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-GVCM9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-O36UB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-FUCAS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-MQPUR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3D3CV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-8FL6N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-AR37R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-SLQEM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-QCBN5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-CVS0N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-DMNCN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-DNPM0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-MSC6K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-UPK50.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-JUSL7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-UOIVF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-IN5H3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-HCP0C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-J7K13.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-OK39U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-1V0GB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-7MEJJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\is-AR9K4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-3PV83.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-2CS23.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-F97JC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-I3IM2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-DQ90M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-CFR84.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-3AB8G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-CRBIK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-DV6EG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-1DJ85.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\is-0JRFM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-LPLPI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-N3N08.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-PJPBU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-SBQPM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-M5LUL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-BN9ON.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-VAH19.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-N0IB9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-A3HPK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-HUJEK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-8NPPR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-CPNT7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-PAE68.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-D14CO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-D3TBF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-DEJS7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-JJD49.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-9JUHQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-OETFQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\unins000.msg
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\server.txt
Creates a software uninstall entry
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
PE / OLE file has a valid certificate
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_mod.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3650560887.0000000000455000.00000002.00000001.01000000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000000.2186074409.0000000000455000.00000002.00000001.01000000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp
Source: Binary string: D:\work\7c64e6304ba228bc\Plugins\nsJSON.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3677455913.000000006F6F6000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\work\3db0bf373ac3fc9b\Release Midex\Midex.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus_ui.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\ed1c64258fb55966\build\Release\thirdparty.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3674626283.000000006AF6E000.00000002.00000001.01000000.00000016.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb@ source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdba source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: NortonBrowserUpdateComRegisterShell64_unsigned.pdb source: NortonBrowserUpdateComRegisterShell64.exe, 0000002C.00000000.2448062254.00007FF757B3B000.00000002.00000001.01000000.0000002D.sdmp
Source: Binary string: NortonBrowserUpdateComRegisterShell64_unsigned.pdb^ source: NortonBrowserUpdateComRegisterShell64.exe, 0000002C.00000000.2448062254.00007FF757B3B000.00000002.00000001.01000000.0000002D.sdmp
Source: Binary string: C:\sciter\sciter\sdk\bin.win\x32\sciter.pdb[ source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hu.pdb source: NortonBrowserUpdateSetup.exe, 00000019.00000003.2277887899.0000000004272000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\9bf849bab5260311\Plugins\Release_Mini\StdUtils.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3675093800.000000006AFA3000.00000002.00000001.01000000.00000015.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\f369f300b8043bce\plugins\src\jsis\build\Release Unicode\jsis.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3676772977.000000006B1F2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\work\c6a7e165ce7a986c\Unicode\Plugins\inetc.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\AvBugReport.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avg_antivirus_free_setup.exe, 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmp, avg_antivirus_free_setup.exe, 00000006.00000000.2154058664.0000000000A73000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\work\893f00f663353e48\bin\x86\MinSizeRel\JsisPlugins.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\21e9bc5e69dd57f1\build\Release Unicode\jsisdl.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\sciter\sciter\sdk\bin.win\x32\sciter.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\msiexec.exeFile opened: z:
Source: C:\Windows\System32\msiexec.exeFile opened: x:
Source: C:\Windows\System32\msiexec.exeFile opened: v:
Source: C:\Windows\System32\msiexec.exeFile opened: t:
Source: C:\Windows\System32\msiexec.exeFile opened: r:
Source: C:\Windows\System32\msiexec.exeFile opened: p:
Source: C:\Windows\System32\msiexec.exeFile opened: n:
Source: C:\Windows\System32\msiexec.exeFile opened: l:
Source: C:\Windows\System32\msiexec.exeFile opened: j:
Source: C:\Windows\System32\msiexec.exeFile opened: h:
Source: C:\Windows\System32\msiexec.exeFile opened: f:
Source: C:\Windows\System32\msiexec.exeFile opened: b:
Source: C:\Windows\System32\msiexec.exeFile opened: y:
Source: C:\Windows\System32\msiexec.exeFile opened: w:
Source: C:\Windows\System32\msiexec.exeFile opened: u:
Source: C:\Windows\System32\msiexec.exeFile opened: s:
Source: C:\Windows\System32\msiexec.exeFile opened: q:
Source: C:\Windows\System32\msiexec.exeFile opened: o:
Source: C:\Windows\System32\msiexec.exeFile opened: m:
Source: C:\Windows\System32\msiexec.exeFile opened: k:
Source: C:\Windows\System32\msiexec.exeFile opened: i:
Source: C:\Windows\System32\msiexec.exeFile opened: g:
Source: C:\Windows\System32\msiexec.exeFile opened: e:
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile opened: c:
Source: C:\Windows\System32\msiexec.exeFile opened: a:
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_00405B6C CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,7_2_00405B6C
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_004028D5 FindFirstFileW,7_2_004028D5
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_0040679D FindFirstFileW,FindClose,7_2_0040679D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1E7010 lstrlenW,lstrcpyW,lstrcpyW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrlenW,lstrcpyW,FindNextFileW,FindClose,7_2_6B1E7010
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extractJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 104.18.21.226 104.18.21.226
Source: Joe Sandbox ViewIP Address: 34.160.176.28 34.160.176.28
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1E91E0 lstrlenW,HttpQueryInfoW,GlobalAlloc,GlobalAlloc,GlobalAlloc,lstrlenW,CreateFileW,GetLastError,InternetReadFile,lstrcpynA,WriteFile,InternetReadFile,GetLastError,InternetQueryOptionW,InternetQueryOptionW,InternetQueryOptionW,wsprintfW,GetLastError,MultiByteToWideChar,GetLastError,wsprintfW,GlobalFree,CloseHandle,DeleteFileW,7_2_6B1E91E0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s:%d;https=https://%s:%dContent-EncodingHTTP/1.0deflate:
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s:%d;https=https://%s:%dHTTP/1.0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004920000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634613540.0000000004920000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004920000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634613540.0000000004920000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv10.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv5.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625213060.0000000004950000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3674119947.0000000004950000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: saBSI.exe, 00000005.00000002.2633360047.0000000005A5A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619864193.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619603678.0000000005A51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.dig%u~
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2507326989.0000000005CCE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2633817380.0000000005ECE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrusted
Source: norton_secure_browser_setup.exe, 00000007.00000002.3673351433.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634932361.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624417763.0000000004835000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000812000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004800000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA2562021CA1.crt0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003526000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616203697.0000000003E6D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2633817380.0000000005ECE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.000000000484C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crtK8
Source: norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crtu
Source: norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com:80/DigiCertTrustedRootG4.crt
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623640986.000000000492D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: saBSI.exe, saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crxB6z
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crxf/
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnx.conceptsheartranch.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2154751260.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2179047230.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2163877224.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2793637519.000000000069A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2792971371.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3654316282.000000000069B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616203697.0000000003E6D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616803346.0000000003E6E000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2260701530.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2208849459.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2392203457.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2444698056.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3056917127.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2418578206.00000000033FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.defence.gov.au/pki0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623640986.000000000492D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.postsignum.cz/crl/psrootqca4.crl02
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.postsignum.eu/crl/psrootqca4.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3635298266.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004829000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000886000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000886000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3635298266.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004829000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000886000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000886000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004931000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623640986.000000000492D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl2.postsignum.cz/crl/psrootqca4.crl01
Source: norton_secure_browser_setup.exe, 00000007.00000002.3673351433.0000000004837000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/
Source: saBSI.exe, 00000005.00000002.2633360047.0000000005A5A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619864193.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619603678.0000000005A51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssured1ub
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2507326989.0000000005CCE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2633817380.0000000005ECE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673351433.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634932361.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624417763.0000000004835000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000812000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA2562021CA1.crl0S
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003526000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616203697.0000000003E6D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: NortonBrowserUpdate.exe, 0000001B.00000003.2317146367.0000000000D12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3673351433.0000000004837000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/Dig
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673351433.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634932361.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624417763.0000000004835000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000812000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA2562021CA1.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3635298266.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004829000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000886000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000886000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3635298266.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004829000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000886000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000886000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabR
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003DF6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enk
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://doubleclick-proxy.ff.avast.com/v1/gclid
Source: norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634258638.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634258638.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003DF6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625409858.00000000048D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gf.tools.avast.com/tools/gf/
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmp, avg_antivirus_free_setup.exe, 00000006.00000000.2154058664.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpString found in binary or memory: http://https://:allow_fallback/installer.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://median-a1.iavs9x.u.avast.com/iavs9x/avast_one_essential_setup_online.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://median-free.iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
Source: norton_secure_browser_setup.exe, 00000007.00000000.2175230031.000000000040A000.00000008.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673351433.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634932361.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624417763.0000000004835000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000812000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.0000000004836000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2633817380.0000000005ECE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.000000000484C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2507326989.0000000005CCE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2633817380.0000000005ECE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003526000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616203697.0000000003E6D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertTrustedRootG4.crtX
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048FF000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.gva.es0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3635298266.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004829000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000886000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000886000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pki.digidentity.eu/validatie0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://push.ff.avast.com
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/0
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.global
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.sb.avast.com/V1/MD/
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.sb.avast.com/V1/PD/
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t2.symcb.com0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tl.symcb.com/tl.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tl.symcb.com/tl.crt0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tl.symcd.com0&
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3650087301.0000000000608000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3650087301.0000000000608000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/K
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3650087301.0000000000608000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/f
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3650087301.0000000000608000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com:80/cgi-bin/iavsevents.cgi
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wtu.d.avcdn.net/avg/wtu/95b029cd737ea13a32d791d4e211fde568448486e62646a07992c7e57969ecf0/WTUI
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wtu.d.avcdn.net/avg/wtu/95b029cd737ea13a32d791d4e211fde568448486e62646a07992c7e57969ecf0/wtu.
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.acabogacia.org/doc0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.acabogacia.org0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623502554.000000000495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ancert.com/cps0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623640986.000000000492D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.anf.es
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623640986.000000000492D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.avast.com0/
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625409858.00000000048D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625409858.00000000048D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003DF6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003DF6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625409858.00000000048D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org1
Source: norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634258638.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.comsign.co.il/cps0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625409858.00000000048D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.0000000004908000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624803221.000000000495C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.defence.gov.au/pki0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172284733.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2388502354.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673351433.0000000004837000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634811369.0000000004857000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634932361.0000000004836000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3622213505.000000000484C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3614619233.0000000004831000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624417763.0000000004835000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673671022.000000000485D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3649223682.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2260660424.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000812000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625499946.0000000004836000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625213060.0000000004950000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3674119947.0000000004950000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625213060.0000000004950000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3674119947.0000000004950000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.disig.sk/ca0f
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.2971580828.0000000002376000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1764203264.00000000025D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1771125880.0000000003500000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007626000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dk-soft.org/
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dnie.es/dpc0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623502554.000000000495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-me.lv/repository0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623502554.000000000495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.eme.lv/repository0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2164152045.0000000000641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/collect
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2793637519.000000000069A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2792971371.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3654316282.000000000069B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/f
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3650087301.0000000000608000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com:80/collect
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513801066.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510490848.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mcafee.com
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oaticerts.com/repository.
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048FF000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.gva.es/cps0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048FF000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.gva.es/cps0%
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004931000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623640986.000000000492D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623502554.000000000495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rcsc.lt/repository0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/cps/0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/juur/crl/0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004931000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623640986.000000000492D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ssc.lt/cps03
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllDELETEPUTCONNECTTRACECOPYLOCKMKCOLMOVEPROPFINDPROPPATCHSEARCHUNLOCKBI
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: norton_secure_browser_setup.exe, 00000007.00000002.3665145583.00000000027C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%HOST_PREFIX%installer.norton.securebrowser.com/policies/license/?l=%LOCALE%licenseAgreement
Source: norton_secure_browser_setup.exe, 00000007.00000002.3665145583.00000000027C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%HOST_PREFIX%installer.norton.securebrowser.com/policies/privacy/?l=%LOCALE%privacyPolicyLin
Source: norton_secure_browser_setup.exe, 00000007.00000002.3665145583.00000000027C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%HOST_PREFIX%installer.norton.securebrowser.com/uninstall-survey/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2234015051.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
Source: norton_secure_browser_setup.exe, 00000007.00000003.2234015051.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://addons.opera.com/extensions/details/avg-online-security
Source: saBSI.exe, 00000005.00000003.2179047230.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2163877224.00000000034DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.co
Source: saBSI.exe, 00000005.00000003.2163877224.00000000034DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/
Source: saBSI.exe, 00000005.00000003.2154751260.00000000034DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/7Z
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/I
Source: saBSI.exe, 00000005.00000003.2154751260.00000000034DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/io
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2163922755.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2153977418.00000000034B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordC
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordf
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/record
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordbq0pzMh1iysE9YiVlC14kJF9ZI
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordnn
Source: saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.comse
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2208849459.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2442862499.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2205386317.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2262252659.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033BA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3056917127.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3056552091.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2392203457.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2208230237.00000000033BA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3662328823.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3057434708.00000000033FF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3661206317.00000000033BC000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2418081564.00000000033BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.3056917127.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3662328823.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3057434708.00000000033FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/f
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2208849459.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3056917127.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2208230237.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2262252659.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2205386317.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3662328823.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3057434708.00000000033FF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3658879355.0000000003397000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.3056344556.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25136ac5
Source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3650560887.0000000000455000.00000002.00000001.01000000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000000.2186074409.0000000000455000.00000002.00000001.01000000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25Sent
Source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3658879355.0000000003358000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net:443/v4/receive/json/252/c686cdd74a82dffd852bfe5b739bd2022835b25941d39493
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.qa.apis.mcafee.com(
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.razerzone.com/downloads/software/RazerEndUserLicenseAgreement.pdf
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bloatware.ff.avast.com/avast/ss/
Source: norton_secure_browser_setup.exe, 00000007.00000002.3665145583.00000000027C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn-%HOST_PREFIX%update.norton.securebrowser.com/installer/%VERSION%/norton-securebrowser%ED
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn-download.avastbrowser.com/avg_secure_browser_setup.exe
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore/detail/avg-online-security/nbmoafcmbajniiapeidgficgifbfmjfo?utm_s
Source: norton_secure_browser_setup.exe, 00000007.00000003.2224284471.0000000000856000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E27000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxargumentsshow-windowretriesdelaycmd.exe
Source: saBSI.exe, 00000005.00000003.2283648590.0000000003529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://confluence.int.mcafee.com/pages/viewpage.action?pageId=35264328
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3653319055.0000000000657000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2792971371.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000668000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2791974919.0000000000656000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3654316282.0000000000689000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3653319055.0000000000657000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000668000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2791974919.0000000000656000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3653319055.0000000000657000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0Cross-Origin-Resource-Policycross-originX
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cu1pehnswad01.servicebus.windows.net/wadp32h02/messages?timeout=60&api-version=2014-01
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.2971580828.00000000023DD000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1764203264.00000000025D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1771125880.0000000003500000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2964729312.0000000004C81000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002460000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2966232856.0000000004D59000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.0000000003854000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/AVG_AV/files/1319/avg.zip
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/AVG_AV/files/1319/avg.zipa
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.0000000003854000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/AVG_AV/images/1509/EN.png
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.2971580828.00000000023DD000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1764203264.00000000025D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1771125880.0000000003500000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2964729312.0000000004C81000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002460000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/CheatEngine/1032/CheatEngine75.exe
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/CheatEngine/1032/CheatEngine75.exee
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.0000000003854000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/NORTON_BRW/files/1506/norton_secure_browser_setup.zip
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002524000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/NORTON_BRW/files/1506/norton_secure_browser_setup.zipu
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/NORTON_BRW/images/1494/547x280/EN.png
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/NORTON_BRW/images/1494/547x280/EN.png1
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/NORTON_BRW/images/1494/547x280/EN.pngD
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038650259.0000000003848000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003899000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.00000000024E1000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipR
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003899000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipca4
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2151142778.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipk
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038650259.0000000003848000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.0000000003854000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/f/WebAdvisor/images/943/EN.png
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.2971580828.00000000023DD000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1764203264.00000000025D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1771125880.0000000003500000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2964729312.0000000004C81000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2966232856.0000000004D9D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/o
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.2971580828.00000000023DD000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1764203264.00000000025D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1771125880.0000000003500000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2964729312.0000000004C81000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2966232856.0000000004D9D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.0000000003854000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002460000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.000000000258A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/zbd
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956243600.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2407153826.0000000000A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/zbd.tmp
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.0000000003854000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net/zbdJ
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1869158376.00000000037CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net:443/f/WebAdvisor/images/943/EN.pngI
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1869158376.00000000037CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net:443/zbd
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d34hwk9wxgk5fi.cloudfront.net:443/zbd9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-autopush.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-preprod.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-staging.corp.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://firefoxextension.avast.com/aos/update.json
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hns-legacy.sb.avast.com
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?id=eula
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2260701530.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2392203457.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2444698056.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3056917127.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2418578206.00000000033FF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320520312.00000000033FF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2266245160.00000000033FF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3662328823.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3057434708.00000000033FF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2418081564.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2356616979.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3652601549.000000000063B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2791974919.0000000000638000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2164152045.0000000000641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/70S
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2208849459.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2205386317.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2262252659.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033BA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2208230237.00000000033BA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/defs/avg-av/release.xml.lzma
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/r
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-atrk/release/avg_antitrack_online_setup.exe
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2164152045.0000000000641000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000656000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-bs/release/avg_battery_saver_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-du/release/avg_driver_updater_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-tu/release/avg_tuneup_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-vpn/release/avg_vpn_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3661206317.00000000033BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/3a9b/c34b/6b2c/3a9bc34b6b2c36180dca72e2d1c706269d1501ebd9b2c37e39e
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/525e/717a/0e3c/525e717a0e3ce0c1c92209926f5fe71e3764ac82eae6d4ad22a
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2418081564.00000000033BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/7dcb/3284/d637/7dcb3284d637fb01aca0aa743bab8ab85de550c34e1bd91be16
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/ba37/d394/2a9c/ba37d3942a9c593900b99a86c846013422428366dc42dc3bca9
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2418081564.00000000033BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/c686/cdd7/4a82/c686cdd74a82dffd852bfe5b739bd2022835b25941d394935b0
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2418081564.00000000033BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/e27c/e913/9c20/e27ce9139c203b6fb8ea8b8d82d50edeb2466df76377db241ab
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2418081564.00000000033BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/ec6a/b4f0/e8de/ec6ab4f0e8de9de8a8c3073baba01c0bdc941f0b50742c666b1
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000668000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/setup/avg-av/release/avg_antivirus_free_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3658879355.0000000003358000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/universe/3a9b/c34b/6b2c/3a9bc34b6b2c36180dca72e2d1c706269d1501ebd9b2c37
Source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3658879355.0000000003358000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/universe/525e/717a/0e3c/525e717a0e3ce0c1c92209926f5fe71e3764ac82eae6d4a
Source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3658879355.0000000003358000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/universe/e27c/e913/9c20/e27ce9139c203b6fb8ea8b8d82d50edeb2466df76377db2
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.avast.com/inAvastium
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.avg.com
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://identityprotection.avg.com
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipm-provider.ff.avast.com/
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipm.avcdn.net/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000000.1763606284.0000000000401000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000871000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2224284471.0000000000871000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000871000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3616374849.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000865000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2224284471.0000000000871000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: norton_secure_browser_setup.exe, 00000007.00000003.2227421964.0000000003E0C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://my.avast.com
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packet-responder.ff.avast.com:8443Vaar-VersionVaar-Header-Content-Type0application/jsonFaile
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pair.ff.avast.com
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://prod1-fe-basic-auth-breach.prod.aws.lifelock.com
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reasonlabs.com/policies
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lu0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://repository.tsp.zetes.com0
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://s-nuistatic.avcdn.net/nui/avg/1.0.756/updatefile.json
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.m
Source: saBSI.exe, 00000005.00000003.2179047230.00000000034DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/
Source: saBSI.exeString found in binary or memory: https://sadownload.mcafee.com/products/SA/
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml/
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml
Source: saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml/
Source: saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2633319482.0000000005A52000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619603678.0000000005A51000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620008607.0000000005A51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml
Source: saBSI.exe, 00000005.00000003.2192425953.0000000003529000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xmll
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml/
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/
Source: saBSI.exe, 00000005.00000003.2619864193.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619603678.0000000005A51000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml
Source: saBSI.exe, 00000005.00000003.2619283321.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2499502259.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619527807.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2283702776.0000000005A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml/
Source: saBSI.exe, saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000003.2179047230.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2163877224.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_main.xml
Source: saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml
Source: saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml/
Source: saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/UPDATER_VERSIONaffidosplatSELF_UPDATE_ALLOWEDMAIN_XMLSTORE
Source: saBSI.exe, saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonPROCESSX
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonRS=2On
Source: saBSI.exe, 00000005.00000003.2619864193.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619603678.0000000005A51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi
Source: saBSI.exe, 00000005.00000003.2619283321.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2499502259.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619527807.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2283702776.0000000005A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml
Source: saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml/
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xmlnload.mcafee.com
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/binaryR
Source: saBSI.exe, 00000005.00000003.2500290213.0000000005A5B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2283702776.0000000005A5A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2499502259.0000000005A5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/965/
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/965/64/installer.exe-r
Source: saBSI.exe, 00000005.00000003.2500290213.0000000005A5B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2283702776.0000000005A5A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2499502259.0000000005A5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/pc/partner_custom_bsi.xml
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2499502259.0000000005A5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/update/post_install.xml
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/update/post_install.xml0
Source: saBSI.exe, 00000005.00000003.2619864193.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619603678.0000000005A51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary
Source: saBSI.exe, 00000005.00000003.2619283321.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2499502259.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619527807.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2283702776.0000000005A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary/
Source: saBSI.exe, 00000005.00000003.2283648590.0000000003529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/v1/pc/partner_custom_vars.xml
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/saLOCALA
Source: saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/saUPDATER_URLupdater.exeWebAdvisor_Updaterheron_hostthreat.ap
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sag
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com:443/products/SA/v1/update/post_install.xmloRbq0pzMh1iysE9YiVlC14kJF9ZI
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sciter.com0/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3635298266.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004829000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000886000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000886000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shepherd.avcdn.net
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3658879355.0000000003376000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmpString found in binary or memory: https://shepherd.avcdn.net/
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2190814115.00000000033A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shepherd.avcdn.net//url
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exe
Source: norton_secure_browser_setup.exe, 00000007.00000002.3662223600.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com/
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003DF6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com/?_=1728855869019&retry_tracking_count=0&last_request_error_code=0&la
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com/X
Source: norton_secure_browser_setup.exe, 00000007.00000002.3662223600.000000000082C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com?_=1728855869019
Source: norton_secure_browser_setup.exe, 00000007.00000002.3665145583.00000000027C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.comnsSetFatalTrackingUrlnorton.installer.fataleventnsAddFatalTrackingPar
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stream-production.avcdn.net
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://submit.sb.avast.com
Source: norton_secure_browser_setup.exe, 00000007.00000003.2208623143.0000000003DFE000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2211603225.0000000003E04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: norton_secure_browser_setup.exe, 00000007.00000003.2208623143.0000000003DFE000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.2211603225.0000000003E04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://viruslab-samples.sb.avast.com
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://viruslab-samples.sb.avast.comhttps://submit.sb.avast.comhttps://hns-legacy.sb.avast.comhttps
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/privacy
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/terms
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/terms7
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://winqual.sb.avast.com
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/license/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/privacy/
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.anf.es/address/)1(0&
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula-avast-consumer-products
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula-avast-consumer-products$
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/priv/U
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/privacy-policy
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2153248293.0000000006A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula/en-us/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.000000000387D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.000000000387A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eulat.net
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2967961343.0000000006A10000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2153248293.0000000006A14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy-us/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.000000000387D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.000000000387A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.000000000386E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/c
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/r
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel05
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ccleaner.com/about/privacy-policy
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ccleaner.com/legal/end-user-license-agreementK
Source: CheatEngine75.exe, 00000009.00000003.2369639447.0000000002291000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cheatengine.org/
Source: CheatEngine75.exe, 00000009.00000003.2369639447.0000000002291000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cheatengine.org/A
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cheatengine.org/privacy.htm
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2954431830.00000000009E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cheatengine.org/privacy.htmdpro
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2146313893.0000000006346000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2130514068.000000000386E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510652445.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2497747469.0000000005B48000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2511341257.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2498983600.0000000003530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513343821.0000000005C61000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2513705095.0000000003537000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2510906930.0000000003530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
Source: norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierra
Source: norton_secure_browser_setup.exe, 00000007.00000003.2233841298.0000000000865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000000.1769759551.0000000000401000.00000020.00000001.01000000.00000004.sdmp, CheatEngine75.exe, 00000009.00000003.2198323283.000000007FB30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.innosetup.com/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/legal.html
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003899000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html6ff069e7a9e9fd65ca
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html:
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlM
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlces-agreement/EN.pngowser_setup.zipLg
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlces-agreement/xe
Source: saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.html
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623502554.000000000495F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.netlock.hu/docs/
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.netlock.net/docs
Source: norton_secure_browser_setup.exe, 00000007.00000003.3616803346.0000000003E6E000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmp, NortonBrowserUpdateSetup.exe, 00000019.00000003.2277887899.0000000004272000.00000004.00000020.00020000.00000000.sdmp, NortonBrowserUpdate.exe, 0000001B.00000003.2317146367.0000000000D12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007511000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/lega
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2964729312.0000000004C81000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007580000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007536000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037B0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.00000000075A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/D
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037B0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/EC86D
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003899000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/EC86Dv
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007601000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/p
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007601000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/pr
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007559000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007580000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007536000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.00000000075EB000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002506000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.00000000075D6000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.000000000252B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002460000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.00000000075A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/0TaMo
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003885000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/;
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003885000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/P
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003885000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/T
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/Y
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/eula/computers
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/eula/computersgcFM
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/privacy
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.premieropinion.com/common/termsofservice-v1
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.premieropinion.com/privacy-policy
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.razer.com/legal/customer-privacy-policy
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000000.1769759551.0000000000401000.00000020.00000001.01000000.00000004.sdmp, CheatEngine75.exe, 00000009.00000003.2198323283.000000007FB30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.remobjects.com/ps
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.thawte.com/cps0/
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.thawte.com/repository0W
Source: norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_00405601 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,7_2_00405601

E-Banking Fraud

barindex
Checks if browser processes are running
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: lstrcpyW,lstrcpyW,lstrcmpW,lstrcpyW,lstrlenW,lstrcpyW,GetFileAttributesW,CreateFileW,GetFileSize,GlobalAlloc,ReadFile,MultiByteToWideChar,GlobalAlloc,MultiByteToWideChar,GlobalFree,CloseHandle,StrStrW,StrStrW,StrStrW,StrStrW,GlobalAlloc,lstrcpynW,GlobalFree,CloseHandle,GlobalFree, \SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppxManifest.xml7_2_6AF62050
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

barindex
Writes many files with high entropy
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe entropy: 7.9934109544Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0 (copy) entropy: 7.99597518735Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1 (copy) entropy: 7.99668482326Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2 (copy) entropy: 7.99994992874Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0.zip (copy) entropy: 7.99597518735Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1.zip (copy) entropy: 7.99668482326Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2.zip (copy) entropy: 7.99994992874Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\installer.exe entropy: 7.99155381417Jump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\9dbb4156-c638-4892-8fca-7492b7a2836c entropy: 7.99867427042Jump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\setupui.cont entropy: 7.99950093996Jump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\d7d319e6-a995-47bb-92b5-c7b1f08cfa98 entropy: 7.99951440014Jump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\6f9be9cc-e43e-4a27-bf97-77fab14f54a1 entropy: 7.99995735727Jump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\511684e9-5057-4028-b2fd-11934b8e0bb7 entropy: 7.99983248956Jump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\e3526f6e-1aba-420e-bce6-afd5a4f27b9c entropy: 7.99988874548Jump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\a1aa0ea5-4861-4bb0-96d1-862772d227e7 entropy: 7.99994482497Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tiny.cepack (copy) entropy: 7.99400748427Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\standalonephase1.cepack (copy) entropy: 7.99178449569Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\standalonephase2.cepack (copy) entropy: 7.99243682541Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\dbk32.cepack (copy) entropy: 7.99403851023Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\dbk64.cepack (copy) entropy: 7.9956449907Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\Tutorial-i386.cepack (copy) entropy: 7.99553499082Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\setupui.cont entropy: 7.99950093996Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_product.dll.lzma entropy: 7.99938660973Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_rvrt.exe.lzma entropy: 7.99302035975Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_product.dll.lzma entropy: 7.99988284299Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_rvrt.exe.lzma entropy: 7.99302035975Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\aswOfferTool.exe.lzma entropy: 7.99977539515Jump to dropped file

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: Process Memory Space: NortonBrowserUpdateComRegisterShell64.exe PID: 3896, type: MEMORYSTRMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: C:\Program Files (x86)\GUT98FF.tmp, type: DROPPEDMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00276220: GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,5_2_00276220
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1E9B40 GetFileAttributesW,CloseHandle,lstrlenW,lstrlenW,lstrlenW,GetFileAttributesW,CloseHandle,GlobalAlloc,CloseHandle,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,GlobalAlloc,CloseHandle,lstrcpyW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,WTSGetActiveConsoleSessionId,CloseHandle,LoadLibraryW,LoadLibraryW,CloseHandle,LoadLibraryW,CloseHandle,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,DuplicateTokenEx,GetTokenInformation,GetTokenInformation,GetTokenInformation,CloseHandle,CreateProcessAsUserW,CloseHandle,CloseHandle,ShellExecuteExW,CloseHandle,CloseHandle,CreateProcessW,CloseHandle,AllowSetForegroundWindow,GlobalFree,CloseHandle,CloseHandle,7_2_6B1E9B40
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_0040350D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,7_2_0040350D
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\43e161.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{469D3039-E8BB-40CB-9989-158443EEA4EB}
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIE307.tmp
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\43e164.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\43e164.msi
Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\43e164.msi
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpCode function: 1_2_0018FDE81_2_0018FDE8
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00274F505_2_00274F50
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00278FB05_2_00278FB0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002770D95_2_002770D9
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0027F1105_2_0027F110
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002973B05_2_002973B0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AD5405_2_002AD540
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002B18405_2_002B1840
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00293AC05_2_00293AC0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AFFE05_2_002AFFE0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002A81905_2_002A8190
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002B83A05_2_002B83A0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AA5405_2_002AA540
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F86095_2_002F8609
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0025A6105_2_0025A610
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002C06605_2_002C0660
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002B47C05_2_002B47C0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002B28A05_2_002B28A0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_003068E05_2_003068E0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002E09195_2_002E0919
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_003009925_2_00300992
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00300AB25_2_00300AB2
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00252B005_2_00252B00
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002E0B4B5_2_002E0B4B
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002B6D435_2_002B6D43
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002E0DB05_2_002E0DB0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002DADD05_2_002DADD0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00288EA05_2_00288EA0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0025CF405_2_0025CF40
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002AF1505_2_002AF150
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0029D2C05_2_0029D2C0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002E933A5_2_002E933A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002EB3405_2_002EB340
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002554005_2_00255400
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F14AF5_2_002F14AF
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002BB4F05_2_002BB4F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002B76025_2_002B7602
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0025F8305_2_0025F830
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002FD8E05_2_002FD8E0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002E390B5_2_002E390B
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002B3A305_2_002B3A30
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0028FB405_2_0028FB40
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00283C505_2_00283C50
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0027BCB05_2_0027BCB0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00257D105_2_00257D10
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A552F06_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A5BB706_2_00A5BB70
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A6C9D06_2_00A6C9D0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A7126C6_2_00A7126C
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A5D3406_2_00A5D340
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A5EDE06_2_00A5EDE0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A666E46_2_00A666E4
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A6CE7E6_2_00A6CE7E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_00406B647_2_00406B64
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF6C7717_2_6AF6C771
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9DAF17_2_6AF9DAF1
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF892197_2_6AF89219
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9D20E7_2_6AF9D20E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9C3CA7_2_6AF9C3CA
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF820FA7_2_6AF820FA
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9D82A7_2_6AF9D82A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF846E27_2_6AF846E2
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF8E7907_2_6AF8E790
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF8C78B7_2_6AF8C78B
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF81C867_2_6AF81C86
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9A47D7_2_6AF9A47D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF8944B7_2_6AF8944B
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9DDAC7_2_6AF9DDAC
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9A59D7_2_6AF9A59D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9D5807_2_6AF9D580
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF98D2E7_2_6AF98D2E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFF6AF07_2_6AFF6AF0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFCE75B7_2_6AFCE75B
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFEA44A7_2_6AFEA44A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0AB3B07_2_6B0AB3B0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFC336A7_2_6AFC336A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0E80C97_2_6B0E80C9
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFC5A597_2_6AFC5A59
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFC5B9D7_2_6AFC5B9D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFC58F97_2_6AFC58F9
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFF1EF47_2_6AFF1EF4
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFCDEEF7_2_6AFCDEEF
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFC9C747_2_6AFC9C74
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFC5DC17_2_6AFC5DC1
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B04D38B7_2_6B04D38B
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFC93277_2_6AFC9327
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1191407_2_6B119140
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0D552D7_2_6B0D552D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1E97307_2_6B1E9730
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6F6F2F077_2_6F6F2F07
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess token adjusted: Load Driver
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess token adjusted: Security
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 002D8713 appears 374 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 002D8DFE appears 111 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 00261BE0 appears 67 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 00298650 appears 192 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 002F4231 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 002D9600 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 002D85BF appears 56 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: String function: 002D8E31 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B1E5170 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCB025 appears 99 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B1E2930 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B036A87 appears 176 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFDF913 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B036A1B appears 217 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCAE1C appears 116 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B0AC191 appears 75 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B0369E8 appears 310 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B036A51 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCAD14 appears 276 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFC25C6 appears 241 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B036772 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCC5E1 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCC4DD appears 303 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCB0CE appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B036AC0 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCC7B4 appears 518 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AF9F420 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFDF8D7 appears 91 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6B01C485 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: String function: 6AFCC6E4 appears 77 times
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6292 -ip 6292
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: installer.exe.5.drStatic PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 24653488 bytes, 137 files, at 0x2c +A "analyticsmanager.cab" +A "analyticstelemetry.cab", number 1, 895 datablocks, 0x1 compression
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: sciterui.dll.7.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: CheatEngine75.tmp.9.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-LB5OD.tmp.10.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: norton_secure_browser_setup.exe.1.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: NortonBrowserUninstall.exe.7.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: sciterui.dll.7.drStatic PE information: No import functions for PE file found
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000000.1763726308.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.2971580828.0000000002438000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: Process Memory Space: NortonBrowserUpdateComRegisterShell64.exe PID: 3896, type: MEMORYSTRMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: C:\Program Files (x86)\GUT98FF.tmp, type: DROPPEDMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpKey value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon versionJump to behavior
Source: CheatEngine75.tmp, 0000000A.00000003.2352854036.0000000000B52000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: 1{app}\autorun\dlls\src\Mono\MonoDataCollector.sln
Source: classification engineClassification label: mal56.rans.bank.spyw.evad.winEXE@85/870@0/13
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_0040350D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,7_2_0040350D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B04A11E __EH_prolog3_catch_GS,__EH_prolog3_catch_GS,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,GetShellWindow,GetWindowThreadProcessId,OpenProcess,GetLastError,GetShellWindow,GetProcessId,OpenProcessToken,GetLastError,DuplicateTokenEx,GetLastError,CreateProcessWithTokenW,GetLastError,GetLastError,7_2_6B04A11E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A552F0 InterlockedExchange,GetCurrentProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CreateMutexW,GetLastError,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CoInitializeEx,CoCreateInstance,CoUninitialize,InterlockedExchange,GetLastError,InterlockedExchange,MessageBoxExW,wsprintfW,wsprintfW,MessageBoxExW,InterlockedExchange,InterlockedExchange,CreateThread,CloseHandle,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,wsprintfW,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,MoveFileExW,GetDiskFreeSpaceExW,InterlockedExchange,InterlockedExchange,MessageBoxExW,InterlockedExchange,GetLastError,InterlockedExchange,wsprintfW,wsprintfW,MessageBoxExW,CloseHandle,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,CreateProcessW,InterlockedExchange,GetLastError,InterlockedExchange,AllowSetForegroundWindow,ResumeThread,InterlockedExchange,GetLastError,InterlockedExchange,PostMessageW,WaitForSingleObject,GetExitCodeProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,CloseHandle,CloseHandle,CloseHandle,_wcsrchr,_wcsrchr,CreateHardLinkW,CopyFileW,ReleaseMutex,CloseHandle,___delayLoadHelper2@8,6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00264C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,5_2_00264C8E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00265C1E CoCreateInstance,OleRun,5_2_00265C1E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00285318 GetModuleHandleW,FindResourceW,LoadResource,LockResource,std::ios_base::_Ios_base_dtor,GetModuleHandleW,GetProcAddress,GetCurrentProcess,Concurrency::cancel_current_task,Concurrency::cancel_current_task,SysFreeString,SysFreeString,5_2_00285318
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Program Files\Norton\Browser\NortonBrowserUninstall.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1a61ad46ea20be40b258533faf1b0048
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4124:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6292
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpMutant created: \Sessions\1\BaseNamedObjects\{9bad0be7-37a7-44b5-940f-7c5abae5b463}Installer
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_03
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\NortonBrowserUpdate{C68009EA-1163-4498-8E93-D5C4E317D8CE}
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeMutant created: \Sessions\1\BaseNamedObjects\norton-securebrowser_installer_mutex2
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\NortonBrowserUpdate{C68009EA-1163-4498-8E93-D5C4E317D8CE}
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5368:120:WilError_03
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\NortonBrowserUpdate{A9A86B93-B54E-4570-BE89-42418507707B}
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\NortonBrowserUpdate{A9A86B93-B54E-4570-BE89-42418507707B}
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{32B25EF2-80FD-4C66-97E1-0890D9E9F87B}
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\NortonBrowserUpdate{D0BB2EF1-C183-4cdb-B218-040922092869}
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Global\11c5957706375e7ac899aac868708f7e
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{9bad0be7-37a7-44b5-940f-7c5abae5b463}Installer
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeFile created: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /silent6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /cookie6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /ppi_icd6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /cust_ini6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Enabled6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxyType6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Port6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: User6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Password6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Properties6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /smbupd6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: enable6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: mirror6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: count6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: servers6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: urlpgm6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: server06_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: http://6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: https://6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: allow_fallback6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: mirror6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: installer.exe6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: {versionSwitch}6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: stable6_2_00A552F0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: %s\%s6_2_00A552F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: norton_secure_browser_setup.exe, norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT ((visits.visit_time/1000000)-11644473600) AS vtime FROM 'visits' ORDER BY vtime DESC LIMIT 1;
Source: norton_secure_browser_setup.exe, norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT last_visit_date / 1000000 AS vtime FROM 'moz_places' ORDER BY vtime DESC LIMIT 1;
Source: norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeReversingLabs: Detection: 39%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeProcess created: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp "C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp" /SL5="$402A0,29027361,780800,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe"
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe" /s /make-default /run_source="norton_ppi_is"
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /ga_clientid:b9592fc5-5741-4a25-98a5-ccd83d3c903a /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeProcess created: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp "C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp" /SL5="$90282,26511452,832512,C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\net.exe "net" stop BadlionAntic
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\net.exe "net" stop BadlionAnticheat
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\sc.exe "sc" delete BadlionAntic
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\sc.exe "sc" delete BadlionAnticheat
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmp helper 105 0x42C
Source: C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmpProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Windows\System32\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe NortonBrowserUpdateSetup.exe /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe "C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe" /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Windows\System32\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeProcess created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regsvc
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6292 -ip 6292
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regserver
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 972
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
Source: unknownProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /c
Source: unknownProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /ua /installsource scheduler
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /registermsihelper
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml /install /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /uninstall
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeProcess created: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp "C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp" /SL5="$402A0,29027361,780800,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=USJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7TgJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe" /s /make-default /run_source="norton_ppi_is"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDISTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /ga_clientid:b9592fc5-5741-4a25-98a5-ccd83d3c903a /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ecJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe NortonBrowserUpdateSetup.exe /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"Jump to behavior
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml /install /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeProcess created: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp "C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp" /SL5="$90282,26511452,832512,C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\net.exe "net" stop BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\net.exe "net" stop BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\sc.exe "sc" delete BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\sc.exe "sc" delete BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmp helper 105 0x42C
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAntic
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe "C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe" /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regsvc
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regserver
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: unknown unknown
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeProcess created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess created: unknown unknown
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6292 -ip 6292
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 972
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /registermsihelper
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /uninstall
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess created: unknown unknown
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: winhttpcom.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: msftedit.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: windows.globalization.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: bcp47mrm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: globinputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dataexchange.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: zipfldr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeSection loaded: cryptnet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: mlang.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: cryptnet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSection loaded: webio.dllJump to behavior
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: version.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: windows.storage.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: wldp.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: profapi.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: cryptsp.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: rsaenh.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: cryptbase.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: dpapi.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: winhttp.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: mswsock.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: iphlpapi.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: winnsi.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: webio.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: sspicli.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: dnsapi.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: rasadhlp.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: schannel.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ntasn1.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ncrypt.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: msasn1.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: gpapi.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ntmarta.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpSection loaded: cscapi.dll
Source: C:\Windows\System32\net.exeSection loaded: mpr.dll
Source: C:\Windows\System32\net.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\net.exeSection loaded: netutils.dll
Source: C:\Windows\System32\net.exeSection loaded: samcli.dll
Source: C:\Windows\System32\net.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exeSection loaded: samcli.dll
Source: C:\Windows\System32\net1.exeSection loaded: netutils.dll
Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\net.exeSection loaded: mpr.dll
Source: C:\Windows\System32\net.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\net.exeSection loaded: netutils.dll
Source: C:\Windows\System32\net.exeSection loaded: samcli.dll
Source: C:\Windows\System32\net.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exeSection loaded: samcli.dll
Source: C:\Windows\System32\net1.exeSection loaded: netutils.dll
Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmpSection loaded: ntmarta.dll
Source: C:\Windows\System32\icacls.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeSection loaded: apphelp.dll
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: msxml3.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: taskschd.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: textinputframework.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: edputil.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: urlmon.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: srvcli.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: appresolver.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: bcp47langs.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: slc.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: sppc.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\icacls.exeSection loaded: ntmarta.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: uxtheme.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: windows.storage.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: wldp.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: propsys.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: profapi.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: edputil.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: urlmon.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: iertutil.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: srvcli.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: netutils.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: sspicli.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: wintypes.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: appresolver.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: bcp47langs.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: slc.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: userenv.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: sppc.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeSection loaded: apphelp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: version.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: opengl32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: wsock32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: uxtheme.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: winmm.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: lua53-64.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: wininet.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: glu32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: msimg32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: explorerframe.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: tcc64-32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: tcc64-64.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: windows.storage.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: wldp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: propsys.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: textshaping.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: xinput1_4.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: devobj.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: inputhost.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: coremessaging.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: wintypes.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: coreuicomponents.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: ntmarta.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: iertutil.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: sspicli.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: profapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: winhttp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: mswsock.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: iphlpapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: winnsi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: urlmon.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: srvcli.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: netutils.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: dnsapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: rasadhlp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: schannel.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: ntasn1.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: msasn1.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: dpapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: cryptsp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: rsaenh.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: cryptbase.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: gpapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: ncrypt.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: textinputframework.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: duser.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: xmllite.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: atlthunk.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: edputil.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: appresolver.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: bcp47langs.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: slc.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: userenv.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: sppc.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
Source: Cheat Engine.lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\Cheat Engine.exe
Source: Cheat Engine (64-bit SSE4-AVX2).lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
Source: Cheat Engine (64-bit).lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe
Source: Cheat Engine (32-bit).lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\cheatengine-i386.exe
Source: Cheat Engine tutorial.lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\Tutorial-i386.exe
Source: Cheat Engine tutorial (64-bit).lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe
Source: Cheat Engine help.lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\CheatEngine.chm
Source: Unload kernel module.lnk.10.drLNK file: ..\..\..\..\..\..\..\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
Source: Reset settings.lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\ceregreset.exe
Source: Lua documentation.lnk.10.drLNK file: ..\..\..\..\..\..\Windows\system32\notepad.exe
Source: Uninstall Cheat Engine.lnk.10.drLNK file: ..\..\..\..\..\..\Program Files\Cheat Engine 7.5\unins000.exe
Source: Cheat Engine.lnk0.10.drLNK file: ..\..\..\Program Files\Cheat Engine 7.5\Cheat Engine.exe
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile written: C:\ProgramData\AVG\Icarus\settings\temporary_proxy.ini
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpWindow found: window name: TSelectLanguageFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpAutomated click: Next
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeAutomated click: OK
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeAutomated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeWindow detected: Number of UI elements: 24
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeWindow detected: Number of UI elements: 39
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDirectory created: C:\Program Files\Norton\Browser\NortonBrowserUninstall.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\unins000.dat
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-LB5OD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-MTART.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-0G0TM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-9T5NT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-K6MH5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-2RDUM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-QJSEK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3MBRG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4H3E6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32\is-AOM6Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64\is-0BCA6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32\is-0OS4A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64\is-7TPL7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win32\is-5JTH0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\win64\is-75A04.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-HME12.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3C6G0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-VBUE0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-24I47.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-298KH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-7Q5CB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-HRQ2J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4D2E6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3KOLE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-Q7DRT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-RBU7H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-NPNPQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-RJ6EI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-MQ1KH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-S8B9H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-NBC6R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-70BUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-IJQFS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-DBQ9C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-50KP0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4HAOD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-78OBP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-8G2RP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-Q6VO1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-5922L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib\is-S6F9T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-4J19G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-QKIFN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-8Q4O2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-8SLG2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-F0SFA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-OR7FQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-I5F7F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-JMH80.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-JJBTV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-44CC1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-B5TJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-OL6VE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-CLTQ6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-V5VS4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-JP1J3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-BR785.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-SUSSO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-70FRS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-2KOGR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-IOSNS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-SDMIC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-PLNB1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-4Q1BH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-O9Q8C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-9U0RQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-K8SDA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-HKILU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-6J8NC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-R00DR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-7NEAF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-GNGMP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-QJL6L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-B5EH7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-BR3E9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-N738R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-CIURU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-KJV2L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-04N8G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-9VBQS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-H4510.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-3C6IU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-I08CQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-Q7RFI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-U7L3I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\is-SM06P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7HMJ2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-Q48TO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7UOLD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-S1JMU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-MR0MU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-EI6G4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-G03C8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-FDRG6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-OR2O6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-C3O5E.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-BT11S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-43AJ9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\is-FLJQJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-K79GF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-D83K0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-TKIKU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-VK45T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-GC3NU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-VCH4D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-OJ9TU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-2FR5R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-GK3MK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\tcc
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\tcc\is-M6HOQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-2AHB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-4KLA5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-R2FR8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-HCTR0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-NDQCS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-3D26K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-1NE8J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-VRBOM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-2DD8C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-C72J0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-S8QLD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-MDU3L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-RVEM5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-426B0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-B7SCC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-LTHHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-ME631.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-6MAEC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-I3SCB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3DASC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-5R3FO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-L3N0T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-TPR80.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-UP51K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-U75H1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-IRTAB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-L1763.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-AKV35.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-9FVFL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-PJLMD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-O5I1D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-1DA6M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-UHV8B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-IDTKR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-TT78L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-QONLV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-AVJBR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-CFLPE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-2D1UK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-DA6UQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-8TGUU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-GCVRT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\languages\is-692Q1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-VKJIS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-2JPQC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-NUSO1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3265L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-4F380.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-D42AS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-PIADI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-2GQ07.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-5AJNR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BKNH7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-V0207.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-ECJSG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-78908.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-L1524.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-6TLNO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-M1718.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-T0R2S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-SUR6B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-ONEVU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-FFQ95.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-2D45H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-A7KQL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-Q3C8H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\images
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-1DU32.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-3VEHV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BOTFQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-TSV58.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BH2HL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-UU2LT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-5NNAH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-BQADR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-ANDBM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-CEL34.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-OA13J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-89VU3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-UTFRU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-K2KFB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-9KS7N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\is-C9ULO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-VGT14.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-8KNKB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-4FINL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-47GOH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-KFVE1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-R7BFR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-4RT86.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-LO9E6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-H6F9C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-NK13K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-KJ922.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-JS32G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-MN8DU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-5RRLD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\is-0OU20.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\xml
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\xml\is-GNT57.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs32
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs32\is-B30AF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs64
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\clibs64\is-K8UEV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-Q14OP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-4PQA1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-QRS1L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-LGQU1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-OTCB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\is-ALU8P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-2M6AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-67UKC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-7TGHP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-NCBT5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-665F7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-LM17N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-SLVPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-U836T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-1QHF1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-KRIHR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-HR134.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\is-O6V9Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-D49SI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-NO8GF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-R0Q39.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-DQKDK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-ARBUH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-S2D5C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-KGL2P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-BIDU2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-CG8FN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-GVCM9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-O36UB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-FUCAS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-MQPUR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-3D3CV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-8FL6N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-AR37R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-SLQEM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-QCBN5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-CVS0N.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-DMNCN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-DNPM0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-MSC6K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\is-UPK50.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-JUSL7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-UOIVF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-IN5H3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-HCP0C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-J7K13.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-OK39U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-1V0GB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-7MEJJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\is-AR9K4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-3PV83.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-2CS23.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-F97JC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-I3IM2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-DQ90M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-CFR84.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-3AB8G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-CRBIK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-DV6EG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-1DJ85.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\is-0JRFM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-LPLPI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-N3N08.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-PJPBU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-SBQPM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-M5LUL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-BN9ON.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-VAH19.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-N0IB9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-A3HPK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-HUJEK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-8NPPR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-CPNT7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-PAE68.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-D14CO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-D3TBF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-DEJS7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-JJD49.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\badassets\is-9JUHQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\is-OETFQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDirectory created: C:\Program Files\Cheat Engine 7.5\unins000.msg
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeDirectory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\server.txt
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cheat Engine_is1
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic PE information: certificate valid
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic file information: File size 29932568 > 1048576
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_mod.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000002.3650560887.0000000000455000.00000002.00000001.01000000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000000.2186074409.0000000000455000.00000002.00000001.01000000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp
Source: Binary string: D:\work\7c64e6304ba228bc\Plugins\nsJSON.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3677455913.000000006F6F6000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\work\3db0bf373ac3fc9b\Release Midex\Midex.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus_ui.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\ed1c64258fb55966\build\Release\thirdparty.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3674626283.000000006AF6E000.00000002.00000001.01000000.00000016.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb@ source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdba source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: NortonBrowserUpdateComRegisterShell64_unsigned.pdb source: NortonBrowserUpdateComRegisterShell64.exe, 0000002C.00000000.2448062254.00007FF757B3B000.00000002.00000001.01000000.0000002D.sdmp
Source: Binary string: NortonBrowserUpdateComRegisterShell64_unsigned.pdb^ source: NortonBrowserUpdateComRegisterShell64.exe, 0000002C.00000000.2448062254.00007FF757B3B000.00000002.00000001.01000000.0000002D.sdmp
Source: Binary string: C:\sciter\sciter\sdk\bin.win\x32\sciter.pdb[ source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hu.pdb source: NortonBrowserUpdateSetup.exe, 00000019.00000003.2277887899.0000000004272000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\9bf849bab5260311\Plugins\Release_Mini\StdUtils.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3675093800.000000006AFA3000.00000002.00000001.01000000.00000015.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\f369f300b8043bce\plugins\src\jsis\build\Release Unicode\jsis.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3676772977.000000006B1F2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\work\c6a7e165ce7a986c\Unicode\Plugins\inetc.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\AvBugReport.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avg_antivirus_free_setup.exe, 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmp, avg_antivirus_free_setup.exe, 00000006.00000000.2154058664.0000000000A73000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\work\893f00f663353e48\bin\x86\MinSizeRel\JsisPlugins.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\21e9bc5e69dd57f1\build\Release Unicode\jsisdl.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\sciter\sciter\sdk\bin.win\x32\sciter.pdb source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmp
Source: is-LPLPI.tmp.10.drStatic PE information: 0xB4CEDA5D [Mon Feb 15 10:26:37 2066 UTC]
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002A2B30 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,GetLastError,5_2_002A2B30
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeStatic PE information: section name: .didata
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp.0.drStatic PE information: section name: .didata
Source: CheatEngine75.exe.1.drStatic PE information: section name: .didata
Source: saBSI.exe.1.drStatic PE information: section name: .didat
Source: avg_antivirus_free_setup.exe.1.drStatic PE information: section name: .didat
Source: installer.exe.5.drStatic PE information: section name: _RDATA
Source: avg_antivirus_free_online_setup.exe.6.drStatic PE information: section name: .didat
Source: icarus_ui.exe.8.drStatic PE information: section name: _RDATA
Source: dump_process.exe.8.drStatic PE information: section name: .didat
Source: dump_process.exe.8.drStatic PE information: section name: _RDATA
Source: bug_report.exe.8.drStatic PE information: section name: _RDATA
Source: icarus.exe.8.drStatic PE information: section name: .didat
Source: icarus.exe.8.drStatic PE information: section name: _RDATA
Source: CheatEngine75.tmp.9.drStatic PE information: section name: .didata
Source: is-3265L.tmp.10.drStatic PE information: section name: /4
Source: is-3D3CV.tmp.10.drStatic PE information: section name: /4
Source: is-LB5OD.tmp.10.drStatic PE information: section name: .didata
Source: is-9T5NT.tmp.10.drStatic PE information: section name: /4
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpCode function: 1_2_0019049F push cs; ret 1_2_001904A4
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002D8DDB push ecx; ret 5_2_002D8DEE
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00307CFD push ecx; ret 5_2_00307D12
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A61396 push ecx; ret 6_2_00A613A9
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF667F6 push ecx; ret 7_2_6AF66809
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9F466 push ecx; ret 7_2_6AF9F479
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B036B10 push ecx; ret 7_2_6B036B23
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0369B6 push ecx; ret 7_2_6B0369C9
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AFE66B5 push ss; retf 7_2_6AFE66B6

Persistence and Installation Behavior

barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u6_2_00A5A100
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-70BUK.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-50KP0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_uk.dllJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_ui.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-IRTAB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fil.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector64.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\CEPluginExample.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\libipt-64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-8SLG2.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-L3N0T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-O5I1D.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\npNortonBrowserUpdate3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\reboot.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tcc32-32-linux.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\gtutorial-i386.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\allochook-i386.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-RJ6EI.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ru.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\DotNetInterface.dll (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_rvrt.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\acuapi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tcc64-32-linux.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdate.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\npNortonBrowserUpdate3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\jsisdl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-VBUE0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-IJQFS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win32\is-5JTH0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\sciterui.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-HRQ2J.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\bug_report.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-UP51K.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateCore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tcc64-64-linux.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\libmikmod64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_mod.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdate.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-S8B9H.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\gtutorial-x86_64.exe (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-24I47.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\zbShieldUtils.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-MQ1KH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-78OBP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-1DA6M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler64.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_product.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\winhook-i386.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\CEJVMTI.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\ceregreset.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-I3SCB.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateSetup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeFile created: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-5922L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\CEJVMTI.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\d3dhook64.dll (copy)Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeFile created: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win32\symsrv.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\installer.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tcc64-aarch64-linux.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Program Files\Norton\Browser\NortonBrowserUninstall.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-MTART.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fi.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_no.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-5R3FO.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_es.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\clibs32\lfs.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win32\dbghelp.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\clibs32\is-B30AF.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_en-GB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-NPNPQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeFile created: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_ui.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-4D2E6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\AccessControl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-TPR80.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-U75H1.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_mr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\acuapi_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-NBC6R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-N3N08.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateSetup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\Midex.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-3265L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win64\symsrv.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-Q7DRT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-Q6VO1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\aswOfferTool.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-3DASC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-0G0TM.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-LPLPI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_kn.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\libipt-32.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\clibs64\is-K8UEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-RBU7H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-9T5NT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\libmikmod32.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psmachine_64.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_cs.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_am.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateCore.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_bg.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_es-419.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_is.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-LB5OD.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\psmachine_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\bug_report.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win64\is-7TPL7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\lua53-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win64\dbghelp.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tcc64-64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-NUSO1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\lua53-64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-3KOLE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-4PQA1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win64\sqlite3.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-QRS1L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-DBQ9C.tmpJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\dump_process.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win64\is-75A04.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\psuser_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-Q14OP.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ja.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\dump_process.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win32\is-0OS4A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_rvrt.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tcc32-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-4HAOD.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-2RDUM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\tcc64-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-OTCB4.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\acuapi_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\d3dhook.dll (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\thirdparty.dllJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\bug_report.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-LGQU1.tmpJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-PJPBU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\acuapi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win32\is-AOM6Q.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateBroker.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateBroker.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-K6MH5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win32\sqlite3.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-8G2RP.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psuser_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-7Q5CB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\jsis.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_product.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\win64\is-0BCA6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-298KH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\JsisPlugins.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeFile created: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\Program Files\Cheat Engine 7.5\is-3D3CV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeFile created: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_rvrt.exeJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_ui.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_rvrt.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_product.dllJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_product.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\bug_report.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_mod.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\bug_report.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_ui.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\aswOfferTool.exeJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\bug_report.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A552F0 InterlockedExchange,GetCurrentProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CreateMutexW,GetLastError,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CoInitializeEx,CoCreateInstance,CoUninitialize,InterlockedExchange,GetLastError,InterlockedExchange,MessageBoxExW,wsprintfW,wsprintfW,MessageBoxExW,InterlockedExchange,InterlockedExchange,CreateThread,CloseHandle,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,wsprintfW,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,MoveFileExW,GetDiskFreeSpaceExW,InterlockedExchange,InterlockedExchange,MessageBoxExW,InterlockedExchange,GetLastError,InterlockedExchange,wsprintfW,wsprintfW,MessageBoxExW,CloseHandle,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,CreateProcessW,InterlockedExchange,GetLastError,InterlockedExchange,AllowSetForegroundWindow,ResumeThread,InterlockedExchange,GetLastError,InterlockedExchange,PostMessageW,WaitForSingleObject,GetExitCodeProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,CloseHandle,CloseHandle,CloseHandle,_wcsrchr,_wcsrchr,CreateHardLinkW,CopyFileW,ReleaseMutex,CloseHandle,___delayLoadHelper2@8,6_2_00A552F0

Boot Survival

barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u6_2_00A5A100
Creates an undocumented autostart registry key
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NortonBrowserUpdate.exe DisableExceptionChainValidation
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NortonBrowserUpdate.exe DisableExceptionChainValidation
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NortonBrowserUpdate.exe DisableExceptionChainValidation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine.lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit SSE4-AVX2).lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit).lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (32-bit).lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial.lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial (64-bit).lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine help.lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Kernel stuff
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Kernel stuff\Unload kernel module.lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Reset settings.lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Lua documentation.lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Uninstall Cheat Engine.lnk
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\net.exe "net" stop BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\sc.exe "sc" delete BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00290540 EnterCriticalSection,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LeaveCriticalSection,5_2_00290540
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
Contain functionality to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: VBoxService.exe VBoxService.exe \VMware\VMware Tools \VMware\VMware Tools QEMU_ QEMU_ VMware Ven_Red_Hat&Prod_VirtIO DiskVBOX DiskVirtual QEMU_ QEMU_ VMware Ven_Red_Hat&Prod_VirtIO DiskVBOX DiskVirtual BOCHS VBOX PRLS 7_2_6B1F0B40
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: VBoxService.exe VBoxService.exe 7_2_6B1F1840
Contains functionality to compare user and computer (likely to detect sandboxes)
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: CreateToolhelp32Snapshot,lstrcmpiW,Process32FirstW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,Process32NextW,CloseHandle,lstrlenW,lstrcpyW,lstrcpyW,lstrcpyW,GetFileAttributesW,GetFileAttributesW,lstrcpyW,GetFileAttributesW,lstrlenW,lstrcpyW,lstrcpyW,GetFileAttributesW,GetFileAttributesW,lstrcpyW,GetFileAttributesW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,lstrcpyW,lstrlenW,lstrlenW,lstrcpyW,GetFileAttributesW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,GetUserNameW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,7_2_6B1F0B40
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeSystem information queried: FirmwareTableInformation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: norton_secure_browser_setup.exeBinary or memory string: DIR_WATCH.DLL
Source: norton_secure_browser_setup.exeBinary or memory string: JOEBOXSERVER.EXE
Source: norton_secure_browser_setup.exe, norton_secure_browser_setup.exe, 00000007.00000002.3677020274.000000006B1FC000.00000004.00000001.01000000.00000010.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
Source: norton_secure_browser_setup.exeBinary or memory string: SBIEDLL.DLL
Source: norton_secure_browser_setup.exeBinary or memory string: API_LOG.DLL
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_A64%/ASWHOOK.DLL</DEST>
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <PATH>%PRODUCT_INST_32%\ASWHOOKX.DLL</PATH>
Source: norton_secure_browser_setup.exeBinary or memory string: SNIFF_HIT.EXE
Source: norton_secure_browser_setup.exeBinary or memory string: JOEBOXCONTROL.EXE
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_32%/ASWHOOK.DLL</DEST>
Source: norton_secure_browser_setup.exeBinary or memory string: C:\MDS\WINDUMP.EXE
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_64%/ASWHOOK.DLL</DEST>
Source: norton_secure_browser_setup.exeBinary or memory string: SYSANALYZER.EXE
Source: norton_secure_browser_setup.exeBinary or memory string: WIRESHARK.EXE
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened / queried: C:\Program Files (x86)\VMware\VMware ToolsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00264C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,5_2_00264C8E
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpCode function: 1_2_001973E0 sldt word ptr [eax]1_2_001973E0
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeWindow / User API: threadDelayed 3828
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeWindow / User API: threadDelayed 1411
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeWindow / User API: threadDelayed 2584
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeWindow / User API: windowPlacementGot 1200
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-70BUK.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdate.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-50KP0.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_uk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-IRTAB.tmpJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_ui.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector64.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\CEPluginExample.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libipt-64.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-8SLG2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-L3N0T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\npNortonBrowserUpdate3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-O5I1D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\reboot.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\gtutorial-i386.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc32-32-linux.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\allochook-i386.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-RJ6EI.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psuser.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ru.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\DotNetInterface.dll (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_rvrt.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\acuapi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc64-32-linux.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdate.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\npNortonBrowserUpdate3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\jsisdl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-VBUE0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-IJQFS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\is-5JTH0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\sciterui.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-HRQ2J.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\bug_report.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-UP51K.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateCore.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc64-64-linux.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libmikmod64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_mod.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-S8B9H.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\gtutorial-x86_64.exe (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-24I47.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\zbShieldUtils.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-MQ1KH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-78OBP.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-1DA6M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_product.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\winhook-i386.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\CEJVMTI.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-I3SCB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ceregreset.exe (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-5922L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\CEJVMTI.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\d3dhook64.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\installer.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc64-aarch64-linux.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fi.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_no.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-5R3FO.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_es.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs32\lfs.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs32\is-B30AF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_en-GB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-NPNPQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\psuser.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_ui.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-4D2E6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\AccessControl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-U75H1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-TPR80.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ro.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\acuapi_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-NBC6R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-N3N08.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\Midex.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\aswOfferTool.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-Q7DRT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-Q6VO1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-3DASC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\nsJSON.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-LPLPI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libipt-32.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs64\is-K8UEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-RBU7H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libmikmod32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-9T5NT.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psmachine_64.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_cs.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_am.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateCore.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_bg.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_es-419.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\psmachine_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\bug_report.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\is-7TPL7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\lua53-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-NUSO1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-3KOLE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-4PQA1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\sqlite3.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-QRS1L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-DBQ9C.tmpJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\dump_process.exeJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\is-75A04.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\psuser_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-Q14OP.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ja.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\dump_process.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\is-0OS4A.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_rvrt.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc32-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-4HAOD.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-OTCB4.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\acuapi_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\d3dhook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\thirdparty.dllJump to dropped file
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\bug_report.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-LGQU1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-PJPBU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\acuapi.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_th.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\is-AOM6Q.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateBroker.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateBroker.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-K6MH5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\sqlite3.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-8G2RP.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psuser_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-7Q5CB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\jsis.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_product.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\is-0BCA6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-298KH.tmpJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUM98FE.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\JsisPlugins.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpDropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-3D3CV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_5-85382
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp TID: 1228Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp TID: 4936Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe TID: 4600Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe TID: 5796Thread sleep time: -60000s >= -30000s
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe TID: 2180Thread sleep time: -9570000s >= -30000s
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe TID: 2180Thread sleep time: -6460000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile Volume queried: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile Volume queried: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile Volume queried: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_00405B6C CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,7_2_00405B6C
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_004028D5 FindFirstFileW,7_2_004028D5
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_0040679D FindFirstFileW,FindClose,7_2_0040679D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1E7010 lstrlenW,lstrcpyW,lstrcpyW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrlenW,lstrcpyW,FindNextFileW,FindClose,7_2_6B1E7010
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002C2782 VirtualQuery,GetSystemInfo,5_2_002C2782
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extractJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: norton_secure_browser_setup.exeBinary or memory string: VMware
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.{D
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000ADD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: s,utm.campaign:opera_new_a","c":"opera_new_a","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"r":["Opera Software"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"cbfo":true,"pv":"1.23","v":3,"x":3}},{"ad":{"n":"","f":"ZB_TotalSecurity_V4","o":"TotalSecurity_AV"},"ps":{"i":"TotalSecurity_AV/images/1127/V4/EN.png","dn":"360 Total Security","u":"TotalSecurity_AV/files/1127/ts360Setup.zip","p":"/s","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\360TotalSecurity","360TotalSecurity","360Safe","VMware, Inc."],"cp":"https://www.360totalsecurity.com/en/privacy/","ctu":"https://www.360totalsecurity.com/en/license/","pv":"1.26","cbfo":true,"v":1}},{"ad":{"n":9,"nn":"Med_Ntiles","f":"ZB_Avast_NCH","o":"Avast_NCH"},"ps":{"i":"AVAST/images/DOTPS-1511/547X280/EN.png","dn":"Avast Antivirus","u":"AVAST/files/cookie_mmm_irs_ppi_005_888_a.zip","p":"/silent /ws /psh:{pxl}","r":["AVAST Software\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\AVG Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1","WebBar","WebDiscoverBrowser","AVG\\Antivirus\\Version","AVG\\AV\\Dir"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"a":["AvastSvc","instup","AvastUI","AVGUI","avguix","AVGSvc","avgsvca"],"ctu":"https://www.avast.com/eula-avast-consumer-products","cp":"https://www.avast.com/privacy-policy","ov":61,"cbfo":true,"pv":"1.29","x":13,"disk":2560,"ram":256,"eapp":["chrome.exe"],"v":1}}],"c":""}!T
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2187838963.000000000339F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: norton_secure_browser_setup.exeBinary or memory string: VBoxService.exe
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
Source: saBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2191397234.00000000033A5000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2190814115.00000000033A8000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2191081077.00000000033A8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllavg-icarus<
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2205386317.00000000033A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.3056688108.00000000033A5000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2260701530.00000000033A5000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219966819.00000000033A5000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2319653795.00000000033A5000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2418710531.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3660481875.00000000033A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2438168493.00000000033A5000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220998708.00000000033A7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@}=
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2954431830.0000000000A17000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2153977418.00000000034C9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2163922755.00000000034C9000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2792971371.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3654316282.0000000000689000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: saBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2153977418.00000000034C9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2163922755.00000000034C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWz]e
Source: norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%hd0
Source: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efD
Source: norton_secure_browser_setup.exeBinary or memory string: QEMU_
Source: avg_antivirus_free_setup.exe, 00000006.00000003.2792971371.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3654316282.0000000000689000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWL
Source: avg_antivirus_free_setup.exe, 00000006.00000002.3650087301.0000000000608000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW $i%SystemRoot%\system32\mswsock.dll
Source: norton_secure_browser_setup.exeBinary or memory string: \VMware\VMware Tools
Source: avg_antivirus_free_online_setup.exe, 00000008.00000003.2190741650.00000000033A8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: e\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeAPI call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeAPI call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1F0B40 CreateToolhelp32Snapshot,lstrcmpiW,Process32FirstW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,Process32NextW,CloseHandle,lstrlenW,lstrcpyW,lstrcpyW,lstrcpyW,GetFileAttributesW,GetFileAttributesW,lstrcpyW,GetFileAttributesW,lstrlenW,lstrcpyW,lstrcpyW,GetFileAttributesW,GetFileAttributesW,lstrcpyW,GetFileAttributesW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,lstrcpyW,lstrlenW,lstrlenW,lstrcpyW,GetFileAttributesW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,GetUserNameW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,StrStrIW,7_2_6B1F0B40
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess queried: DebugPortJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F70B4 IsDebuggerPresent,OutputDebugStringW,5_2_002F70B4
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00275204 RegOpenKeyExW,RegQueryValueExW,SetLastError,RegCloseKey,RegCloseKey,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,LoadLibraryExW,GetLastError,5_2_00275204
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00264C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,5_2_00264C8E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_00307BC0 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C5_2_00307BC0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002A2B30 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,GetLastError,5_2_002A2B30
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002EE8FE mov eax, dword ptr fs:[00000030h]5_2_002EE8FE
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F7C6A mov eax, dword ptr fs:[00000030h]5_2_002F7C6A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F7CAE mov eax, dword ptr fs:[00000030h]5_2_002F7CAE
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F7CF2 mov eax, dword ptr fs:[00000030h]5_2_002F7CF2
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F7D23 mov eax, dword ptr fs:[00000030h]5_2_002F7D23
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A67C5A mov eax, dword ptr fs:[00000030h]6_2_00A67C5A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF65683 mov eax, dword ptr fs:[00000030h]7_2_6AF65683
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF8FBBF mov eax, dword ptr fs:[00000030h]7_2_6AF8FBBF
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF914BE mov eax, dword ptr fs:[00000030h]7_2_6AF914BE
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9147A mov eax, dword ptr fs:[00000030h]7_2_6AF9147A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0E7528 mov eax, dword ptr fs:[00000030h]7_2_6B0E7528
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0E75B4 mov eax, dword ptr fs:[00000030h]7_2_6B0E75B4
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0D0835 mov eax, dword ptr fs:[00000030h]7_2_6B0D0835
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_0026463F GetProcessHeap,5_2_0026463F
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess token adjusted: Debug
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess token adjusted: Debug
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess token adjusted: Debug
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess token adjusted: Debug
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess token adjusted: Debug
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002D9018 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_002D9018
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002D93F2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_002D93F2
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002DD453 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_002DD453
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002D9586 SetUnhandledExceptionFilter,5_2_002D9586
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A610FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00A610FF
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A61292 SetUnhandledExceptionFilter,6_2_00A61292
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A613AB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00A613AB
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A64476 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00A64476
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF66349 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_6AF66349
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF6504A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6AF6504A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF669A2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6AF669A2
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9F76F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6AF9F76F
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF8FCD2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6AF8FCD2
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6AF9F47B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_6AF9F47B
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B037AD6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6B037AD6
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B037CDA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_6B037CDA
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0B7181 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6B0B7181
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1E58D0 lstrcmpW,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,7_2_6B1E58D0

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeNtQueryInformationProcess: Indirect: 0x7FFDFB6BC34D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1EB610 nsExecLogonUser,7_2_6B1EB610
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=USJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7TgJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe "C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe" /s /make-default /run_source="norton_ppi_is"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /ga_clientid:b9592fc5-5741-4a25-98a5-ccd83d3c903a /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ecJump to behavior
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml /install /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmp helper 105 0x42C
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAntic
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAnticheat
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeProcess created: unknown unknown
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeProcess created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exeProcess created: unknown unknown
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6292 -ip 6292
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 972
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exeProcess created: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe "C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /registermsihelper
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess created: unknown unknown
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92ptu5hvrwhs3vwuipmbbbicevfeywa6bnyeo3ouurqxz1n2xpozesfjqk8de1eko42xxrqtatx7tg /cookie:mmm_irs_ppi_902_451_o /ga_clientid:b9592fc5-5741-4a25-98a5-ccd83d3c903a /edat_dir:c:\windows\temp\asw.a66b047c9b0289ec
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe nortonbrowserupdatesetup.exe /silent /install "bundlename=norton private browser&appguid={3a3642e6-de46-4f68-9887-aa017eefe426}&appname=norton private browser&needsadmin=true&lang=en-gb&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe "c:\program files (x86)\gum98fe.tmp\nortonbrowserupdate.exe" /silent /install "bundlename=norton private browser&appguid={3a3642e6-de46-4f68-9887-aa017eefe426}&appname=norton private browser&needsadmin=true&lang=en-gb&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe c:\windows\temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe /icarus-info-path:c:\windows\temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml /install /silent /ws /psh:92ptu5hvrwhs3vwuipmbbbicevfeywa6bnyeo3ouurqxz1n2xpozesfjqk8de1eko42xxrqtatx7tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:c:\windows\temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92ptu5hvrwhs3vwuipmbbbicevfeywa6bnyeo3ouurqxz1n2xpozesfjqk8de1eko42xxrqtatx7tg /cookie:mmm_irs_ppi_902_451_o /ga_clientid:b9592fc5-5741-4a25-98a5-ccd83d3c903a /edat_dir:c:\windows\temp\asw.a66b047c9b0289ecJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe nortonbrowserupdatesetup.exe /silent /install "bundlename=norton private browser&appguid={3a3642e6-de46-4f68-9887-aa017eefe426}&appname=norton private browser&needsadmin=true&lang=en-gb&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"Jump to behavior
Source: C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe c:\windows\temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe /icarus-info-path:c:\windows\temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml /install /silent /ws /psh:92ptu5hvrwhs3vwuipmbbbicevfeywa6bnyeo3ouurqxz1n2xpozesfjqk8de1eko42xxrqtatx7tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:c:\windows\temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a
Source: C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe "c:\program files (x86)\gum98fe.tmp\nortonbrowserupdate.exe" /silent /install "bundlename=norton private browser&appguid={3a3642e6-de46-4f68-9887-aa017eefe426}&appname=norton private browser&needsadmin=true&lang=en-gb&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1EA3A0 GetVersion,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,7_2_6B1EA3A0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002D9215 cpuid 5_2_002D9215
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,5_2_002F45DA
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,5_2_002FC907
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,5_2_002FC952
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,5_2_002FC9ED
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,5_2_002FCA80
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,5_2_002FCCE0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,5_2_002FCE06
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,5_2_002FCF0C
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,5_2_002FCFDB
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoEx,5_2_002D7E28
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,5_2_002F3F6D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6AF94278
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,7_2_6AF9439E
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,7_2_6AF94025
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6AF91164
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6AF93EFF
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6AF93EB4
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6AF93E0D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6AF93F9A
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6AF944A4
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6AF90C40
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,7_2_6AF93C12
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,7_2_6AF94573
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,7_2_6B0EEB75
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6B0EEA4D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6B0E2F18
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,7_2_6B0EED50
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6B0EEC7D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoEx,7_2_6B03637C
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,7_2_6B0EE3C3
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6B0EE76D
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,7_2_6B0EE7F8
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6B0EE669
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: EnumSystemLocalesW,7_2_6B0EE6D2
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6B0EE5C0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,7_2_6B0E39CC
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,GetUserDefaultUILanguage,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,wsprintfW,7_2_6B1E78C0
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: GetLocaleInfoW,GlobalAlloc,GlobalAlloc,GlobalAlloc,lstrcpyW,lstrcpyW,wsprintfW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,7_2_6B1E7510
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: nsGetLocaleInfo,GetLocaleInfoW,7_2_6B1EE580
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\logo.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\WebAdvisor.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\AVG_AV.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\AVG_BRW.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\finish.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeCode function: 5_2_002F4619 GetSystemTimeAsFileTime,5_2_002F4619
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B1279B6 __EH_prolog3_GS,LookupAccountNameW,GetLastError,7_2_6B1279B6
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeCode function: 7_2_6B0E26E8 _free,GetTimeZoneInformation,_free,7_2_6B0E26E8
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 6_2_00A541B0 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetVersionExA,GetNativeSystemInfo,wsprintfA,wsprintfA,lstrcatA,lstrlenA,6_2_00A541B0
Source: C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: norton_secure_browser_setup.exeBinary or memory string: C:\virus\virus.exe
Source: norton_secure_browser_setup.exeBinary or memory string: wireshark.exe
Source: norton_secure_browser_setup.exeBinary or memory string: C:\Kit\procexp.exe
Source: norton_secure_browser_setup.exeBinary or memory string: C:\virus.exe
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior
Source: C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NortonBrowserUpdate.exe DisableExceptionChainValidation

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-releaseJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PreferencesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WIN_XP
Source: norton_secure_browser_setup.exe, 00000007.00000002.3675839130.000000006B13E000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: k...RtlGetVersionD:\work\6641f181bd7f7928\src\acu\windows\utility\OSUtils.cppD:\work\6641f181bd7f7928\src\acu\windows\utility\OSUtils.cppSeIncreaseQuotaPrivilege{} {}WIN_XPVISTAWIN7WIN8WIN8_1WIN10WIN11UNKNOWNMicrosoft\Internet Explorer\Quick Launch\User Pinned\TaskBar.lnkrunasCreating unelevated process {} {}Attempting to execute {} as a trusted executableTrust not established so execution has been abortedunelevatedcurrentTrust has been established so executing in {} contextChecking candidate thumbprint {}no-matchmatchedVerify certificate thumbprint for {} ({}) [{}]Validate certificate thumbprint for {} failed [{:#018x}]VInv{}alid signature for {} [result({:#010x}), possiblySelfSigned({}), allowSelfSigned({})]Validate signature for {} failed [{:#018x}]Verifying trust for {}not Trust {}established BuildCmdArgsToDeleteSelf::pathToDel [{}])BuildCmdArgsToDeleteSelf::rmParentDirDepth [{}])BuildCmdArgsToDeleteSelf::timeoutSecs [{}])/c timeout /nobreak /t {} && del /F /Q {}..BuildCmdArgsToDeleteSelf::subpath [{}]) && rmdir /Q {}BuildCmdArgsToDeleteSelf::cmdargs {}cmd.exeProcessDeleteSelf::cmdexe [{}]OSUtils::ProcessDeleteSelf: {} {}D:(A;OICI;GA;;;BA)(A;OICI;GRDT;;;WD)1\/J
Source: norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ...RtlGetVersionD:\work\6641f181bd7f7928\src\acu\windows\utility\OSUtils.cppD:\work\6641f181bd7f7928\src\acu\windows\utility\OSUtils.cppSeIncreaseQuotaPrivilege{} {}WIN_XPVISTAWIN7WIN8WIN8_1WIN10WIN11UNKNOWNMicrosoft\Internet Explorer\Quick Launch\User Pinned\TaskBar.lnkrunasCreating unelevated process {} {}Attempting to execute {} as a trusted executableTrust not established so execution has been abortedunelevatedcurrentTrust has been established so executing in {} contextChecking candidate thumbprint {}no-matchmatchedVerify certificate thumbprint for {} ({}) [{}]Validate certificate thumbprint for {} failed [{:#018x}]VInv{}alid signature for {} [result({:#010x}), possiblySelfSigned({}), allowSelfSigned({})]Validate signature for {} failed [{:#018x}]Verifying trust for {}not Trust {}established BuildCmdArgsToDeleteSelf::pathToDel [{}])BuildCmdArgsToDeleteSelf::rmParentDirDepth [{}])BuildCmdArgsToDeleteSelf::timeoutSecs [{}])/c timeout /nobreak /t {} && del /F /Q {}..BuildCmdArgsToDeleteSelf::subpath [{}]) && rmdir /Q {}BuildCmdArgsToDeleteSelf::cmdargs {}cmd.exeProcessDeleteSelf::cmdexe [{}]OSUtils::ProcessDeleteSelf: {} {}D:(A;OICI;GA;;;BA)(A;OICI;GRDT;;;WD)1\/J

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
1
Software		Acquire Infrastructure2
Valid Accounts		3
Native API		1
LSASS Driver		1
Abuse Elevation Control Mechanism		3
Disable or Modify Tools		1
OS Credential Dumping		2
System Time Discovery		Remote Services11
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomains1
Replication Through Removable Media		12
Command and Scripting Interpreter		1
DLL Side-Loading		1
LSASS Driver		1
Deobfuscate/Decode Files or Information		LSASS Memory11
Peripheral Device Discovery		Remote Desktop Protocol1
Data from Local System		2
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Scheduled Task/Job		1
Image File Execution Options Injection		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		Security Account Manager1
Account Discovery		SMB/Windows Admin Shares1
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts11
Service Execution		2
Valid Accounts		1
Image File Execution Options Injection		2
Obfuscated Files or Information		NTDS4
File and Directory Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd22
Windows Service		2
Valid Accounts		1
Timestomp		LSA Secrets57
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
Scheduled Task/Job		21
Access Token Manipulation		1
DLL Side-Loading		Cached Domain Credentials1
Query Registry		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd Timers11
Registry Run Keys / Startup Folder		22
Windows Service		1
File Deletion		DCSync681
Security Software Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration Job1
Bootkit		12
Process Injection		23
Masquerading		Proc Filesystem25
Virtualization/Sandbox Evasion		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting Interpreter1
Services File Permissions Weakness		1
Scheduled Task/Job		2
Valid Accounts		/etc/passwd and /etc/shadow12
Process Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCron11
Registry Run Keys / Startup Folder		1
Modify Registry		Network Sniffing1
Application Window Discovery		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchd1
Services File Permissions Weakness		25
Virtualization/Sandbox Evasion		Input Capture3
System Owner/User Discovery		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task21
Access Token Manipulation		Keylogging1
Remote System Discovery		Taint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers12
Process Injection		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service
Business RelationshipsServerTrusted RelationshipVisual BasicContainer Orchestration JobContainer Orchestration Job1
Bootkit		Web Portal CaptureLocal GroupsComponent Object Model and Distributed COMLocal Email CollectionInternal ProxyCommonly Used PortDirect Network Flood
Identify Business TempoBotnetHardware AdditionsPythonHypervisorProcess Injection1
Services File Permissions Weakness		Credential API HookingDomain GroupsExploitation of Remote ServicesRemote Email CollectionExternal ProxyTransfer Data to Cloud AccountReflection Amplification

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1532785 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 13/10/2024 Architecture: WINDOWS Score: 56 186 Malicious sample detected (through community Yara rule) 2->186 188 Antivirus / Scanner detection for submitted sample 2->188 190 Multi AV Scanner detection for submitted file 2->190 192 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->192 11 SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe 2 2->11         started        14 NortonBrowserUpdate.exe 2->14         started        16 svchost.exe 2->16         started        18 2 other processes 2->18 process3 file4 148 SecuriteInfo.com.W...NV4.31044.30727.tmp, PE32 11->148 dropped 20 SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp 5 33 11->20         started        25 NortonBrowserUpdate.exe 14->25         started        27 NortonBrowserUpdate.exe 14->27         started        29 WerFault.exe 16->29         started        process5 dnsIp6 152 108.138.2.128 AMAZON-02US United States 20->152 106 C:\Users\...\norton_secure_browser_setup.exe, PE32 20->106 dropped 108 C:\Users\...\avg_antivirus_free_setup.exe, PE32 20->108 dropped 110 C:\Users\user\AppData\Local\...\saBSI.exe, PE32 20->110 dropped 112 9 other files (7 malicious) 20->112 dropped 194 Writes many files with high entropy 20->194 31 avg_antivirus_free_setup.exe 1 3 20->31         started        36 norton_secure_browser_setup.exe 40 109 20->36         started        38 CheatEngine75.exe 20->38         started        40 3 other processes 20->40 file7 signatures8 process9 dnsIp10 158 142.250.186.110 GOOGLEUS United States 31->158 160 34.117.223.223 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 31->160 162 23.212.89.10 AKAMAI-ASUS United States 31->162 92 C:\...\avg_antivirus_free_online_setup.exe, PE32 31->92 dropped 172 Query firmware table information (likely to detect VMs) 31->172 174 Contains functionality to infect the boot sector 31->174 42 avg_antivirus_free_online_setup.exe 31->42         started        164 192.229.221.95 EDGECASTUS United States 36->164 166 104.20.86.8 CLOUDFLARENETUS United States 36->166 94 C:\Users\user\AppData\...\thirdparty.dll, PE32 36->94 dropped 96 C:\Users\user\AppData\Local\...\sciterui.dll, PE32 36->96 dropped 98 C:\Users\user\AppData\Local\...\reboot.dll, PE32 36->98 dropped 104 10 other files (none is malicious) 36->104 dropped 176 Contain functionality to detect virtual machines 36->176 178 Checks if browser processes are running 36->178 180 Tries to harvest and steal browser information (history, passwords, etc) 36->180 184 3 other signatures 36->184 46 NortonBrowserUpdateSetup.exe 36->46         started        100 C:\Users\user\AppData\...\CheatEngine75.tmp, PE32 38->100 dropped 48 CheatEngine75.tmp 38->48         started        168 20.42.73.29 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 40->168 170 3 other IPs or domains 40->170 102 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 40->102 dropped 182 Writes many files with high entropy 40->182 50 cheatengine-x86_64-SSE4-AVX2.exe 40->50         started        file11 signatures12 process13 dnsIp14 130 C:\Windows\Temp\...\icarus.exe, PE32+ 42->130 dropped 132 C:\Windows\Temp\...\setupui.cont, XZ 42->132 dropped 134 C:\...\e3526f6e-1aba-420e-bce6-afd5a4f27b9c, LZMA 42->134 dropped 142 9 other files (5 malicious) 42->142 dropped 202 Query firmware table information (likely to detect VMs) 42->202 204 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 42->204 206 Writes many files with high entropy 42->206 53 icarus.exe 42->53         started        136 C:\...136ortonBrowserUpdate.exe, PE32 46->136 dropped 144 71 other files (none is malicious) 46->144 dropped 58 NortonBrowserUpdate.exe 46->58         started        138 cheatengine-x86_64-SSE4-AVX2.exe (copy), PE32+ 48->138 dropped 140 C:\Program Files\...\tiny.cepack (copy), data 48->140 dropped 146 124 other files (6 malicious) 48->146 dropped 60 net.exe 48->60         started        62 net.exe 48->62         started        64 sc.exe 48->64         started        66 6 other processes 48->66 150 104.20.95.94 CLOUDFLARENETUS United States 50->150 208 Found direct / indirect Syscall (likely to bypass EDR) 50->208 file15 signatures16 process17 dnsIp18 154 1.1.1.1 CLOUDFLARENETUS Australia 53->154 156 34.160.176.28 ATGS-MMD-ASUS United States 53->156 114 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 53->114 dropped 116 C:\Windows\Temp\...\icarus_product.dll, PE32+ 53->116 dropped 118 C:\Windows\Temp\...\aswOfferTool.exe, PE32 53->118 dropped 126 15 other files (8 malicious) 53->126 dropped 196 Query firmware table information (likely to detect VMs) 53->196 198 Writes many files with high entropy 53->198 120 C:\...120ortonBrowserUpdate.exe, PE32 58->120 dropped 122 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 58->122 dropped 124 C:\Program Files (x86)124orton\...\psuser.dll, PE32 58->124 dropped 128 70 other files (none is malicious) 58->128 dropped 200 Creates an undocumented autostart registry key 58->200 68 NortonBrowserUpdate.exe 58->68         started        70 NortonBrowserUpdate.exe 58->70         started        72 conhost.exe 60->72         started        74 net1.exe 60->74         started        76 conhost.exe 62->76         started        78 net1.exe 62->78         started        80 conhost.exe 64->80         started        82 conhost.exe 66->82         started        84 3 other processes 66->84 file19 signatures20 process21 process22 86 NortonBrowserUpdateComRegisterShell64.exe 68->86         started        88 NortonBrowserUpdateComRegisterShell64.exe 68->88         started        90 NortonBrowserUpdateComRegisterShell64.exe 68->90         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe39%ReversingLabsWin32.Trojan.Generic
SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe100%AviraPUA/OfferCore.Gen

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler64.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateBroker.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateComRegisterShell64.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateCore.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateOnDemand.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateSetup.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateWebPlugin.exe0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\acuapi.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\acuapi_64.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdate.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_am.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ar.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bg.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bn.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ca.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_cs.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_da.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_de.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_el.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en-GB.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es-419.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_et.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fa.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fi.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fil.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fr.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_gu.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hi.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hr.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hu.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_id.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_is.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_it.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_iw.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ja.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_kn.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ko.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lt.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lv.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ml.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_mr.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ms.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_nl.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_no.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pl.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-BR.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-PT.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ro.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ru.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sk.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sl.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sr.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sv.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sw.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ta.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_te.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_th.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_tr.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_uk.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ur.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_vi.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-CN.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-TW.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\npNortonBrowserUpdate3.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\psmachine.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\psmachine_64.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\psuser.dll0%ReversingLabs
C:\Program Files (x86)\GUM98FE.tmp\psuser_64.dll0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler.exe0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler64.exe0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdate.exe0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateBroker.exe0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateCore.exe0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateOnDemand.exe0%ReversingLabs
C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateSetup.exe0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://www.innosetup.com/0%URL Reputationsafe
https://wwww.certigna.fr/autorites/0m0%URL Reputationsafe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
http://www.quovadisglobal.com/cps00%URL Reputationsafe
http://ocsp.accv.es00%URL Reputationsafe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#0%URL Reputationsafe
http://www.dk-soft.org/0%URL Reputationsafe
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://webcompanion.com/termsSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpfalse
    		unknown
    http://ocsp.suscerte.gob.ve0norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
      		unknown
      http://crl.dhimyotis.com/certignarootca.crl0norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        https://analytics.apis.mcafee.comsesaBSI.exe, 00000005.00000002.2631938277.000000000345E000.00000004.00000020.00020000.00000000.sdmpfalse
          		unknown
          http://www.chambersign.org1norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
            		unknown
            https://honzik.avcdn.net/defs/avg-av/release.xml.lzmaavg_antivirus_free_online_setup.exe, 00000008.00000003.2208849459.0000000003400000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2205386317.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2221477162.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2262252659.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033BA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2208230237.00000000033BA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2320190560.00000000033BB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2219658013.00000000033F0000.00000004.00000020.00020000.00000000.sdmpfalse
              		unknown
              http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                http://crl.ssc.lt/root-c/cacrl.crl0norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  https://www.avg.com/ww-en/privacynet/rSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    https://docs.google.com/norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://ca.disig.sk/ca/crl/ca_disig.crl0norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625213060.0000000004950000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3674119947.0000000004950000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        https://www.avg.com/ww-en/eulat.netSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.000000000387D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.000000000387A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.000000000386E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          https://firefoxextension.avast.com/aos/update.jsonavg_antivirus_free_online_setup.exe, 00000008.00000003.2419022371.0000000005C61000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            https://sadownload.mcafee.com/products/sa/bsi/win/binary/saBSI.exe, 00000005.00000003.2619283321.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2499502259.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619527807.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2500290213.0000000005A6D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2283702776.0000000005A6D000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              https://www.avast.com/priv/USecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://www.suscerte.gob.ve/dpc0norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://www.disig.sk/ca/crl/ca_disig.crl0norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625213060.0000000004950000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3674119947.0000000004950000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://www.avg.com/ww-en/eula/en-us/SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2153248293.0000000006A14000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://www.avg.com/ww-en/privacynet/cSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.000000000387E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.000000000387D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2172478611.000000000387A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2171663493.000000000386E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://www.innosetup.com/SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000000.1769759551.0000000000401000.00000020.00000001.01000000.00000004.sdmp, CheatEngine75.exe, 00000009.00000003.2198323283.000000007FB30000.00000004.00001000.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://winqual.sb.avast.comavg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://pki.registradores.org/normativa/index.htm0norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://policy.camerfirma.com0norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?norton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0avg_antivirus_free_setup.exe, 00000006.00000003.2792971371.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000684000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000668000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2791974919.0000000000656000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3654316282.0000000000689000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2793517435.0000000000687000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000002.3653319055.0000000000657000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://www.certicamara.com/dpc/0Znorton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0Gnorton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://wwww.certigna.fr/autorites/0mnorton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://drive-daily-2.corp.google.com/norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://repository.tsp.zetes.com0norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exeavg_antivirus_free_setup.exe, 00000006.00000003.2164152045.0000000000641000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2163996407.0000000000656000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://drive-daily-5.corp.google.com/norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://pair.ff.avast.comavg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://www.mcafee.com/consumer/en-us/policy/legal.html:SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://https://:allow_fallback/installer.exeavg_antivirus_free_setup.exe, 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmp, avg_antivirus_free_setup.exe, 00000006.00000000.2154058664.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpfalse
                                                                    		unknown
                                                                    http://submit.sb.avast.com/V1/PD/avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://honzik.avcdn.net/70Savg_antivirus_free_setup.exe, 00000006.00000002.3652601549.000000000063B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2791974919.0000000000638000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2164152045.0000000000641000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://www.cheatengine.org/CheatEngine75.exe, 00000009.00000003.2369639447.0000000002291000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://www.mcafee.com/consumer/en-us/policy/legal.htmlMSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://www.cheatengine.org/privacy.htmdproSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2954431830.00000000009E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://sadownload.mcafee.com/products/SA/v1/bsisaBSI.exe, 00000005.00000003.2619864193.0000000005A54000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2619603678.0000000005A51000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://crl2.postsignum.cz/crl/psrootqca4.crl01norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exeavg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      http://www.acabogacia.org0norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.avast.com0/SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2152994718.0000000006A17000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://www.nortonlifelock.com/us/en/legal/license-services-agreement/DSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://webcompanion.com/terms7SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://d34hwk9wxgk5fi.cloudfront.net/f/NORTON_BRW/images/1494/547x280/EN.pngSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://web.certicamara.com/marco-legal0Znorton_secure_browser_setup.exe, 00000007.00000003.3623423878.0000000004934000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://www.quovadisglobal.com/cps0norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • URL Reputation: safe
                                                                                                  		unknown
                                                                                                  https://reasonlabs.com/policiesSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A84000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://d34hwk9wxgk5fi.cloudfront.net:443/zbd9C73F5E5-7AE7-4E32-A8E8-8D23B85255BFSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.00000000037D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://www.correo.com.uy/correocert/cps.pdf0norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3625409858.00000000048D1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://ipm.avcdn.net/avg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://sadownload.mcafee.com/saBSI.exe, 00000005.00000003.2179047230.00000000034DC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://www.avg.com/ww-en/privacy-us/SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2153248293.0000000006A14000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              http://v7event.stats.avast.com/avg_antivirus_free_setup.exe, 00000006.00000002.3650087301.0000000000608000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://d34hwk9wxgk5fi.cloudfront.net/f/NORTON_BRW/files/1506/norton_secure_browser_setup.zipuSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2959380110.0000000002524000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://www.anf.es/AC/RC/ocsp0cnorton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://assets.razerzone.com/downloads/software/RazerEndUserLicenseAgreement.pdfSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2038712636.0000000000ABC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xmlsaBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2620317057.0000000003524000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://www.ancert.com/cps0norton_secure_browser_setup.exe, 00000007.00000003.3623502554.000000000495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://chrome.google.com/webstore/detail/avg-online-security/nbmoafcmbajniiapeidgficgifbfmjfo?utm_savg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            http://%s:%d;https=https://%s:%dContent-EncodingHTTP/1.0deflate:norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000030DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              http://median-a1.iavs9x.u.avast.com/iavs9x/avast_one_essential_setup_online.exeavg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://ocsp.accv.es0norton_secure_browser_setup.exe, 00000007.00000003.3624289073.0000000004902000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624964106.0000000004908000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                		unknown
                                                                                                                                http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://rca.e-szigno.hu/ocsp0-norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1768609412.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1766632259.0000000002710000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    		unknown
                                                                                                                                    http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623911089.0000000004926000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://www.nortonlifelock.com/us/en/legal/license-services-agreement/EC86DvSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003899000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xmlsaBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2631938277.0000000003522000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2178006483.000000000351F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://cdn-%HOST_PREFIX%update.norton.securebrowser.com/installer/%VERSION%/norton-securebrowser%EDnorton_secure_browser_setup.exe, 00000007.00000002.3665145583.00000000027C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://analytics.apis.mcafee.com/IsaBSI.exe, 00000005.00000002.2631938277.00000000034C7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://www.nortonlifelock.com/us/en/prSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007601000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://%s:%d;https=https://%s:%dHTTP/1.0avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://www.dk-soft.org/SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.2971580828.0000000002376000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000003.1764203264.00000000025D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1771125880.0000000003500000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2968290783.0000000007626000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://www.avg.com/ww-en/privacynet/SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2427596578.0000000003889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2963870305.0000000003887000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405321142.0000000003884000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://www.thawte.com/cps0/norton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://drive-daily-0.corp.google.com/norton_secure_browser_setup.exe, 00000007.00000003.2217217283.0000000000856000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://d34hwk9wxgk5fi.cloudfront.net/f/AVG_AV/images/1509/EN.pngSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2956357504.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000002.2962448261.0000000003854000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.2405788338.0000000000A37000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://www.thawte.com/repository0Wnorton_secure_browser_setup.exe, 00000007.00000002.3668568273.00000000033C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://crl.defence.gov.au/pki0norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634258638.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://www.catcert.net/verarrel05norton_secure_browser_setup.exe, 00000007.00000003.3623570341.0000000004953000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://sadownload.mcafee.com/products/SA/UPDATER_VERSIONaffidosplatSELF_UPDATE_ALLOWEDMAIN_XMLSTOREsaBSI.exe, 00000005.00000000.2132290597.000000000031E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://www.datev.de/zertifikat-policy-bt0norton_secure_browser_setup.exe, 00000007.00000003.3624964106.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://www.comsign.co.il/cps0norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634258638.0000000004917000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://d34hwk9wxgk5fi.cloudfront.net:443/f/WebAdvisor/images/943/EN.pngISecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, 00000001.00000003.1869158376.00000000037CC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://acraiz.icpbrasil.gov.br/LCRacraizv10.crl0norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673867295.0000000004920000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3634613540.0000000004920000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUSecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe, 00000000.00000000.1763606284.0000000000401000.00000020.00000001.01000000.00000003.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://www.e-me.lv/repository0norton_secure_browser_setup.exe, 00000007.00000003.3623336194.0000000004942000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623502554.000000000495F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#avg_antivirus_free_setup.exe, 00000006.00000003.2183024350.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3635298266.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3671889407.0000000003E41000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3673177293.0000000004829000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3626244780.0000000000886000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000002.3662223600.0000000000886000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2358270721.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2323796627.0000000006010000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000002.3663419871.0000000005370000.00000002.00000001.00040000.00000012.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2267736968.0000000005D51000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2220258633.0000000005B0B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000008.00000003.2394887912.0000000005DF5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  http://crl.chambersign.org/chambersroot.crl0norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624222548.0000000004919000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3624138804.000000000490A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml/saBSI.exe, 00000005.00000003.2620225604.000000000351E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192344748.0000000003518000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2192376857.0000000003519000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://prod1-fe-basic-auth-breach.prod.aws.lifelock.comavg_antivirus_free_online_setup.exe, 00000008.00000003.2448475872.0000000005C31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        http://www.postsignum.cz/crl/psrootqca2.crl02norton_secure_browser_setup.exe, 00000007.00000003.3624352365.00000000048F9000.00000004.00000020.00020000.00000000.sdmp, norton_secure_browser_setup.exe, 00000007.00000003.3623714413.000000000484D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown

                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                          Public IPs

                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                          1.1.1.1
                                                                                                                                                                                          		unknownAustralia
                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                          104.18.21.226
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                          108.138.2.128
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                          52.36.31.154
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                          34.160.176.28
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                          104.20.95.94
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                          34.117.223.223
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                          2.19.126.156
                                                                                                                                                                                          		unknownEuropean Union
                                                                                                                                                                                          		16625AKAMAI-ASUSfalse
                                                                                                                                                                                          23.212.89.10
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		16625AKAMAI-ASUSfalse
                                                                                                                                                                                          104.20.86.8
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                          20.42.73.29
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                          142.250.186.110
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                          192.229.221.95
                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                          		15133EDGECASTUSfalse

                                                                                                                                                                                          General Information

                                                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                          Analysis ID:1532785
                                                                                                                                                                                          Start date and time:2024-10-13 23:42:41 +02:00
                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                          Overall analysis duration:0h 14m 14s
                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                          Report type:full
                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                          Run name:Run with higher sleep bypass
                                                                                                                                                                                          Number of analysed new started processes analysed:52
                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                          Number of injected processes analysed:0
                                                                                                                                                                                          Technologies:
                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                                                          Sample name:SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                          Classification:mal56.rans.bank.spyw.evad.winEXE@85/870@0/13
                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                          • Successful, ratio: 75%
                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                          • Successful, ratio: 89%
                                                                                                                                                                                          • Number of executed functions: 136
                                                                                                                                                                                          • Number of non-executed functions: 200
                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                          • Found application associated with file extension: .exe
                                                                                                                                                                                          • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                                          Warnings

                                                                                                                                                                                          • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                          • Execution Graph export aborted for target SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp, PID 6292 because there are no executed function
                                                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                          • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                          • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                          • VT rate limit hit for: SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe

                                                                                                                                                                                          Simulations

                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                          17:45:21API Interceptor601092x Sleep call for process: cheatengine-x86_64-SSE4-AVX2.exe modified
                                                                                                                                                                                          22:44:48Task SchedulerRun new task: NortonUpdateTaskMachineCore path: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe s>/c
                                                                                                                                                                                          22:44:48Task SchedulerRun new task: NortonUpdateTaskMachineUA path: C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe s>/ua /installsource scheduler
                                                                                                                                                                                          22:46:43Task SchedulerRun new task: Norton Private Browser Heartbeat Task (Hourly) path: C:\Program Files\Norton\Browser\Application\NortonBrowser.exe s>--type=heartbeat --hourly
                                                                                                                                                                                          22:46:43Task SchedulerRun new task: Norton Private Browser Heartbeat Task (Logon) path: C:\Program Files\Norton\Browser\Application\NortonBrowser.exe s>--type=heartbeat --logon
                                                                                                                                                                                          22:46:54AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NortonBrowserAutoLaunch_9295589C6A3342EB5FB8AB20D67446E2 "C:\Program Files\Norton\Browser\Application\NortonBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default"

                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                          IPs

                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                          1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                                                                                                                          • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                                                                                                                                          AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          • 1.1.1.1/
                                                                                                                                                                                          INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                          • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                                                                                                                                          Go.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          • 1.1.1.1/
                                                                                                                                                                                          104.18.21.226faststone-capture_voLss-1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                                            faststone-capture_voLss-1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                                              moba-24.2-installer_M64ZB-1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                                                hashtab-6.0.0.34-installer_rxb9-U1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                                                  SecuriteInfo.com.Riskware.OfferCore.702.11507.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                                                                    Form_Ver-14-00-21 (1).jsGet hashmaliciousBazar Loader, BruteRatel, LatrodectusBrowse
                                                                                                                                                                                                      YandexPackLoader.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        YandexPackLoader.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          AnyDesk_new_Soft.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            wechat-3.9.7-installer_ae-GFz1.exeGet hashmaliciousCoinhive, Crypto Miner, DarkComet, GhostRat, IcedID, LaZagne, Mini RATBrowse
                                                                                                                                                                                                              34.160.176.28SecuriteInfo.com.Program.Unwanted.5511.32425.5112.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                SecuriteInfo.com.Program.Unwanted.5511.32425.5112.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  SecuriteInfo.com.Trojan.Siggen29.7508.16428.4641.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    Team Fortress 2 Brotherhood Of Arms_aez-LU1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      Team Fortress 2 Brotherhood Of Arms_aez-LU1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeGet hashmaliciousPrivateLoaderBrowse
                                                                                                                                                                                                                          SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeGet hashmaliciousPrivateLoaderBrowse
                                                                                                                                                                                                                            winrar-64-6.21-installer_AmGAP-1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                                                                              ccsetup624.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                Domains

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                ASNs

                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                CLOUDFLARENETUSfile.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 172.67.206.204
                                                                                                                                                                                                                                SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                                                • 104.20.4.235
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.Evo-gen.15503.22039.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 172.67.206.204
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.Evo-gen.11764.10915.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8
                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8
                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8
                                                                                                                                                                                                                                SecuriteInfo.com.Variant.Lazy.606929.21165.21266.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 172.67.206.204
                                                                                                                                                                                                                                SecuriteInfo.com.Variant.Lazy.606929.30223.9667.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8
                                                                                                                                                                                                                                AMAZON-02UShttps://fexegreuyauja-8124.vercel.app/mixc.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 76.76.21.22
                                                                                                                                                                                                                                https://verfiy-blue-badge-sign-up.vercel.app/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 76.76.21.98
                                                                                                                                                                                                                                https://shawnoreplyonlineaccess.weebly.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 50.112.173.192
                                                                                                                                                                                                                                https://webmaillshavv.weebly.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 50.112.173.192
                                                                                                                                                                                                                                https://shawwebmailll.weebly.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 54.201.56.249
                                                                                                                                                                                                                                https://pub-6e60812ea6034887a73a58b17a92a80f.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 18.239.18.15
                                                                                                                                                                                                                                https://f120987.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 18.239.83.12
                                                                                                                                                                                                                                https://japroippouquafou-5881.vercel.app/mixc.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 76.76.21.142
                                                                                                                                                                                                                                https://kucoinexplora.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 52.214.156.76
                                                                                                                                                                                                                                CLOUDFLARENETUSfile.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 172.67.206.204
                                                                                                                                                                                                                                SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                                                • 104.20.4.235
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.Evo-gen.15503.22039.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 172.67.206.204
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.Evo-gen.11764.10915.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8
                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8
                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8
                                                                                                                                                                                                                                SecuriteInfo.com.Variant.Lazy.606929.21165.21266.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 172.67.206.204
                                                                                                                                                                                                                                SecuriteInfo.com.Variant.Lazy.606929.30223.9667.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                • 104.21.53.8

                                                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler64.exeLisect_AVT_24003_G1B_127.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                                                                                  SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                                                                                                    SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                                                                                                      C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler.exeLisect_AVT_24003_G1B_127.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                                                                                                        SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                                                                                                          SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse

                                                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                                                            C:\Config.Msi\43e163.rbs

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                            Size (bytes):7854
                                                                                                                                                                                                                                            Entropy (8bit):5.494376771141946
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:/geNKRyzSIgzSzXReJ7aY7jMgDwzgs+Bd4C/Q/Bp:/9KkzezkXRo2Y7jMgDBBd4C/Q/Bp
                                                                                                                                                                                                                                            MD5:FC46C5D1EC629D59B9942256C3DCE1CC
                                                                                                                                                                                                                                            SHA1:FD8C0E6DE0E4BA17604676888EB4B5CED15D4A3D
                                                                                                                                                                                                                                            SHA-256:5C10F063A7E72617ACD57F435ABA20E739D065DE9016934C88ED94079D9E2026
                                                                                                                                                                                                                                            SHA-512:172963B87A1C39BAA820A66D8746FA5FBF0B32F900FDCD2D47572E79DB3E610B685B1F28C999584ADF77892755DB597DFC44A2BD5D5F65D5BEA7055A302B5371
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...@IXOS.@.....@..MY.@.....@.....@.....@.....@.....@......&.{469D3039-E8BB-40CB-9989-158443EEA4EB}..Norton Update Helper..NortonBrowserUpdateHelper.msi.@.....@q....@.....@........&.{F1F27AB3-30CC-48BD-90B4-7AA3CF80EB1F}.....@.....@.....@.....@.......@.....@.....@.......@......Norton Update Helper......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{717B7059-A988-492F-AF1B-DCF70BE809AB}&.{469D3039-E8BB-40CB-9989-158443EEA4EB}.@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@......SOFTWARE\Norton\Browser\Update.............................................. ...!.......?........... ... .......?...................?.........................................8......................1.?l.cL<.P...b....~z................. ... ...................$.N.......@....'.&...MsiStubRun..#0....RegisterProduct..Registering product..[1]......C:\Windows\Installer\4

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\@PaxHeader

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):28
                                                                                                                                                                                                                                            Entropy (8bit):3.5566567074628233
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:XVTKlUv:FTj
                                                                                                                                                                                                                                            MD5:B9EA04357667FD46353CA3E48F346261
                                                                                                                                                                                                                                            SHA1:CB35A329D04D990B937CB8C6C49ACC8D80AD45A3
                                                                                                                                                                                                                                            SHA-256:FDF34D3C6716526200DFC4F81AD1CB1BFDA51EC9DB20C2C0E7CDD08C179A6DE3
                                                                                                                                                                                                                                            SHA-512:5B07BA516C030BD3689F21939A2EEA417B603A9FA8BEBCF4D9BAED190B67E7784F1A0458A022450F5DDD99F6D9913BA45D2EB1DCE4E011842A5CB33B3695C93B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:28 mtime=1686233326.3398783.

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):383232
                                                                                                                                                                                                                                            Entropy (8bit):4.3682050352007735
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:iPfhJk6XlsbrElrmPARuDnQe09E32yIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AD:cfYKsHKmz+K32OTixcvcDwn
                                                                                                                                                                                                                                            MD5:1694092D5DE0E0DAEF4C5EA13EA84CAB
                                                                                                                                                                                                                                            SHA1:894F3E31CC3666728F2D7A8DB6840D4726843DE5
                                                                                                                                                                                                                                            SHA-256:A178FFAD4526B68BA0106032D612164004F20F08B8EF7FDF986429A1CF7708A0
                                                                                                                                                                                                                                            SHA-512:882A9392507BF0E089952F17E2F40DB0C5E1C52C6A6F5C7CDAD61DEDAF1AF734F23C317C0DA77A980D6ACC38E169302E1B024AD393BB730851786146BC38E17E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                                            • Filename: Lisect_AVT_24003_G1B_127.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2R..aR..aR..a...`X..a...`...a...`F..a...`t..a...`C..a...`@..a...`Q..aR..a...a...`S..a..%aS..a...`S..aRichR..a........................PE..L......d............................T.............@.................................t\....@.................................d'..(....P..(f..........H....6..........L...T...............................@............................................text............................... ..`.rdata..<].......^..................@..@.data........0....... ..............@....rsrc...(f...P...h...*..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserCrashHandler64.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):404480
                                                                                                                                                                                                                                            Entropy (8bit):4.403596063022666
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Pzfvhld4VAmlAfFUtxsIKGNGdyIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBAA9:bvhP4VHlAfFUYdOTixcvcK
                                                                                                                                                                                                                                            MD5:09621280025727AB4CB39BD6F6B2C69E
                                                                                                                                                                                                                                            SHA1:A6F3796A310B064D1F2A06FAA9B14C4A104506DA
                                                                                                                                                                                                                                            SHA-256:77B695E9292A10A98C3FC1D25AE05C44FB18A54D74A473D4497B840C8BA94DEA
                                                                                                                                                                                                                                            SHA-512:CBA5DAB19BDEAFC4ECA223A4858B566E3AF21FD690F4F6971864C519D284AAF5A3DF70B98AEB5FABC66A68E515505B203B0BF1C61ECB92070E8E30A92BDA6FAC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                                            • Filename: Lisect_AVT_24003_G1B_127.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g0...^...^...^.;v]...^.;v[.U.^.;vZ...^.s[...^.sZ...^.s]...^.;v_...^..._..^.sW...^.s....^.s\...^.Rich..^.........PE..d...=..d.........."..........6.................@.............................@.......z....`..................................................l..(.......0f..........H....7...0..T...pW..T............................W..8...............@............................text............................... ..`.rdata..............................@..@.data................f..............@....pdata...............r..............@..@_RDATA..............................@..@.rsrc...0f.......h..................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):440608
                                                                                                                                                                                                                                            Entropy (8bit):4.477495049012643
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:TjbidjsOQe3H/lqa8ggDemWSzuwJWwqjPpiIFWNjdkjAGAOK0Lxmb9rvp3AzAwBv:ytqa8VxJMReTixcvcF4fZNVw
                                                                                                                                                                                                                                            MD5:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            SHA1:B267CCB3BBE06A0143C1162F462839645780D22E
                                                                                                                                                                                                                                            SHA-256:66E75EA8A3641E419D5226E062F8F17624AFBEE3D7EFD1D6517890511E7111D9
                                                                                                                                                                                                                                            SHA-512:512F2C2BE5EE5F61F31719344CD20DD731898C5B63F6E1ABDBFC81821533D93AE06C96F256AC1196E9F457A927C4AA61C35D00B45181793547FF3B6670866CCA
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.<r..R!..R!..R!..Q ..R!..W ..R!..V ..R!B.V ..R!B.Q ..R!B.W <.R!..S ..R!..S!s.R!H.[ ..R!H.!..R!...!*.R!H.P ..R!Rich..R!........PE..L...b..d.................<...L......;z.......P....@......................................@.................................`q..x...................H....8...........^..T...................@_......X^..@............p..\............................text....:.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc................T..............@..@.reloc...............n..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateBroker.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):384296
                                                                                                                                                                                                                                            Entropy (8bit):4.381583745540333
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Vvs32BUKqsL6FBqrk0z3M+82nOiIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBAn:Bs3Uq+2qXnOeTixcvcGLNI
                                                                                                                                                                                                                                            MD5:A86AD7C0E95907CBA12C65A752C02821
                                                                                                                                                                                                                                            SHA1:26EE2DF5A6A47FE976AF1592B20BCBEBDAFFC4DB
                                                                                                                                                                                                                                            SHA-256:4E596090A150EB2B7478A42B7A2287EB8E0C80ACF2776AA7A55DFE9CC5013718
                                                                                                                                                                                                                                            SHA-512:62D869B8FEC28D10EC6A1B78B6F92555B0DBA2E92BAC203C569CACCB30B1BB33128346C158A04262271D43D09AB0ED207B99A19354215D5A8907FCA01B654C60
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L....d..........................................@.................................R:....@.................................$8..<....`...f..........H....6...........-..T...........................`-..@............................................text...s........................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc....f...`...f...0..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateComRegisterShell64.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):438592
                                                                                                                                                                                                                                            Entropy (8bit):6.45992761938075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:/iooQx+F24u9wHXNiOc20bNcooY50EkY:/mQUkyiOc20ZcW0Er
                                                                                                                                                                                                                                            MD5:35BDDD897E9CF97CF4074A930F78E496
                                                                                                                                                                                                                                            SHA1:69D5E69DDF4132FA2A5AE8B8B36CE047E560A476
                                                                                                                                                                                                                                            SHA-256:B2DAA382D892FEDB01EE0FC960671A96C1D21C663F1883D800F70D72FDD13F91
                                                                                                                                                                                                                                            SHA-512:A484F13F5427B20623BC0451BD223C0D89EDA0B0789749B46F2981CD7818A0D795B2868840E5BB9A0C6C8020939D085814A6BBBAAE4425B2F0C398C913F246DF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5..PTg.PTg.PTg.$d.[Tg.$b..Tg..!c.BTg..!d.ZTg..!b..Tg..!n.kTg.$c.ETg.$f.MTg.PTf..Ug..!b.QTg..!..QTg..!e.QTg.RichPTg.................PE..d......d.........."............................@....................................R.....`..................................................................p..t4..Hx...8......d.......T.......................(... ...8............................................text.............................. ..`.rdata...|.......|..................@..@.data...08...0......................@....pdata..t4...p...6..................@..@_RDATA...............d..............@..@.rsrc................f..............@..@.reloc..d............j..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateCore.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):755696
                                                                                                                                                                                                                                            Entropy (8bit):5.78064070271127
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:W7HWEcC7f+bctMN8hnPTscowfOTieHsgX+:W7HWvbcNPTJowfOu2u
                                                                                                                                                                                                                                            MD5:5174340282DD8A0FF39480395F5BC5D8
                                                                                                                                                                                                                                            SHA1:08100AB4E019A149CC484BDA66CCC5C28DC2D2ED
                                                                                                                                                                                                                                            SHA-256:C78E5106DEBB7D891A9B3DF684EDE2DA295B8E7B595F899CEB8400786A627EC6
                                                                                                                                                                                                                                            SHA-512:8B2A3DB0DEE98435F2C5ACF8DE8617FE72ADD9155F3AF491CDFBE6770346DD31CAD387D3E2877E3E5332117A30D08DA428CBF9C7E3C72C6E6E486F4626BFD1AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.P.4.P.4.P.D.Q.4.P.D.Q84.P.hjP.4.P.A.Q.4.P.A.Q.4.P.A.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.4.P.6.P.A.Q.5.P.AhP.4.P.A.Q.4.PRich.4.P........PE..L....d............................0t............@.......................................@..............................................f..........HD...C...`...A..Xw..T....................x.......w..@...............8............................text...*........................... ..`.rdata..............................@..@.data...DG..........................@....rsrc....f.......f..................@..@.reloc...A...`...B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateHelper.msi

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Norton Update Helper, Author: Norton LifeLock, Keywords: Installer, Comments: (c) 2022 Norton LifeLock, Template: Intel;1033, Revision Number: {F1F27AB3-30CC-48BD-90B4-7AA3CF80EB1F}, Create Time/Date: Thu Jun 8 11:50:54 2023, Last Saved Time/Date: Thu Jun 8 11:50:54 2023, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):3.710330368678027
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gPeAETBOSI7Ley3M5ICNsSSAoHx5Pey3M5IC0ioXh:SMBOS8eWMmCNsjeWMmCE
                                                                                                                                                                                                                                            MD5:079852B401B4C83A1982255DCFD795B3
                                                                                                                                                                                                                                            SHA1:4C54232099461DECAD52F45F827503B7C40C8BD0
                                                                                                                                                                                                                                            SHA-256:1F0CBF6DE9A292E02474D32763D54F22108FB15226BD4D2D5B8113C3207A1248
                                                                                                                                                                                                                                            SHA-512:1F07204FCD763FBFDA6D535F9CF4C9971045CBFF3127A2464E46529A8E59FF5269490ED5AB74F71FD957F0ABF3B42D2CF8258F12738D543097EC0DF89E8FFB2C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateOnDemand.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):384808
                                                                                                                                                                                                                                            Entropy (8bit):4.377706577325397
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:zvMP2ZEKysLSFBqr80w3M+D2nKiIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBAW:bMPMy+eqLnKeTixcvcjLNm
                                                                                                                                                                                                                                            MD5:C9824519E8613D8B4CAD44060069C19C
                                                                                                                                                                                                                                            SHA1:8D253977D0236494471FBFDAA6AB3EEF1315AC15
                                                                                                                                                                                                                                            SHA-256:11F3E42F19333E5917E7DB62FA8E7F966EB9624E86711E413AA43284B8D03244
                                                                                                                                                                                                                                            SHA-512:0F2E11E11C1C8D477EA8C2C6C70D24484AE913CC1FC785E945141BD035745914CA307D67BDEC3A45D443BEBEDDB536A910E4E1F2A285AA807217576262AE4D21
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L......d..........................................@.......................................@.................................,8..<....`...f..........H....6...........-..T...........................`-..@............................................text...s........................... ..`.rdata..j^.......`..................@..@.data........@.......&..............@....rsrc....f...`...h...0..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateSetup.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1910576
                                                                                                                                                                                                                                            Entropy (8bit):7.58137479903026
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:hbGcPcWSOwiGJ+aKznZOqbU3tFKU+9wOKXd9AVjrr:xGGcWSYGJ+94iU3tIU+qOs
                                                                                                                                                                                                                                            MD5:2B07E26D3C33CD96FA825695823BBFA7
                                                                                                                                                                                                                                            SHA1:EBD3E4A1A58B03BFD217296D170C969098EB2736
                                                                                                                                                                                                                                            SHA-256:2A97CB822D69290DF39EBAA2F195512871150F0F8AFF7783FEA0B1E578BBB0BA
                                                                                                                                                                                                                                            SHA-512:1B204322ACA2A66AEDF4BE9B2000A9C1EB063806E3648DBAB3AF8E42C93CA0C35E37A627802CD14272273F3F2E9BC55847DFA49FC6E8FFB58F39683E2446E942
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].T...:...:...:...9...:...?...:...>...:.K.>...:.K.9...:.K.?.).:.A.3...:...;...:...;.n.:.A....:......:.A.8...:.Rich..:.................PE..L...]..d.................n...J.......R............@.................................u.....@.....................................x.... ..|...........H....j..............T...........................@...@............................................text....m.......n.................. ..`.rdata..Fr.......t...r..............@..@.data...............................@....rsrc...|.... ......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdateWebPlugin.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):384808
                                                                                                                                                                                                                                            Entropy (8bit):4.377540113876844
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:A3sX2IVBI6XgpbbreB3Hu9+323+iIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBU:qsXTIgmbl3+eTixcvcXbM/H
                                                                                                                                                                                                                                            MD5:1B7BD9F313FC670D5DFC1EDFEEF50D0E
                                                                                                                                                                                                                                            SHA1:F95F0DB0E6392022D314EFD14F9B4D542D2DF3C2
                                                                                                                                                                                                                                            SHA-256:968A9AE84C45CF635CAB1F50843CD970FAE0BDF3F7837FE26D7D64C8E3C0A837
                                                                                                                                                                                                                                            SHA-512:232FFA2890FC3504EE8D2DECB80603B5873C8AC9E8F92D09E3E4BE7AFAE7DD88121CD176F5C487BB59809B577705F226B7C63D8743CBE4FCEABFECD429D765FD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L......d..........................................@.................................5.....@.................................,8..<....`...f..........H....6...........-..T...........................`-..@............................................text............................... ..`.rdata..j^.......`..................@..@.data........@.......&..............@....rsrc....f...`...h...0..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\acuapi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):561456
                                                                                                                                                                                                                                            Entropy (8bit):6.89287156869539
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:Yfpc+D07/a7PLl5FibVV1e80fe7KM7DhphezIhSMXlLSGvYOO:ID0KcVV1e8IkKM7DjhezIhSMXl+onO
                                                                                                                                                                                                                                            MD5:A400B5A4A3CA4745149ABAA4C58FAB2D
                                                                                                                                                                                                                                            SHA1:D8BC7CF9735E4A6958FEB7079A505BD1C4516F24
                                                                                                                                                                                                                                            SHA-256:89515235500904C8BD34844D4C71F2707750BC5E7C48AFD3409B012EB5A1E544
                                                                                                                                                                                                                                            SHA-512:2762EE517E08FEBA6345521ADF6C516352B672882DB2A6D3220F2A62A60EFB6CB2DD2AB04BDC20A60092A5922A4B7C83484C8FD3FAAC3BA817A4BDE84D23592A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................E.....................................u...........................Rich...........PE..L...[..d...........!.........p............................................................@.............................l.......(....@..p...........HT...<...P...8......T...................@.......h...@............................................text...d........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...p....@......................@..@.reloc...8...P...:..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\acuapi_64.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):719056
                                                                                                                                                                                                                                            Entropy (8bit):6.672324901238704
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:X+vBHtQ7iF5WOFQYOupOwoH6LztpMQV/t9WQF2FiWurraKlIDn1LGNGho44v+aXx:X+5HnQYOAR7WGtZhezIhSMXlgIv
                                                                                                                                                                                                                                            MD5:56464A7270CDE8F1EFE3A4DF0C7FBA88
                                                                                                                                                                                                                                            SHA1:3B857008BDB409DAEF3441C656C0CA09B283F80E
                                                                                                                                                                                                                                            SHA-256:85FBCDB8D8FF254D35664000529BC1FDE00427B624F806E6A2CF839AD7332698
                                                                                                                                                                                                                                            SHA-512:A0E7E8C45129E44D775DBB3DE53D72F17EA17EBDCCA89C0C69B56FB6AD3694227466452387378F915241390769BDF42B5E58D104C8C1839915878DD698F30CDF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.b2w..aw..aw..a!..`r..a...`{..a...`...a...`c..a%..`y..a%..`}..a%..`8..a...`p..aw..a...a/..`u..a/..`v..a/..av..a/..`v..aRichw..a........................PE..d......d.........." ................................................................aB....`..........................................A..p....A..(.......x........A..H....B......$...x...T.......................(......8............................................text...,........................... ..`.rdata..n}.......~..................@..@.data....?...P...&...8..............@....pdata...A.......B...^..............@..@_RDATA..............................@..@.rsrc...x...........................@..@.reloc..$...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdate.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1707520
                                                                                                                                                                                                                                            Entropy (8bit):6.329347716504747
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:Lpkb22RntN0ttjsz1srDlmsmTKmTyuuNV:Lpka2Rn0ttjsQlms7
                                                                                                                                                                                                                                            MD5:5F2D68D3FDAEB09AE78622A5AE59FCE0
                                                                                                                                                                                                                                            SHA1:D959C2A9E03C0C4017682C5F48EB1BBD84DD796E
                                                                                                                                                                                                                                            SHA-256:F2AF299BE74EBBFD19BB476D66BDE4D55BFB571004B6349EB5EF1971955F683F
                                                                                                                                                                                                                                            SHA-512:D0F9BA99DF9153A8487FD0C4A3F81C0138AEABAAED9875A8E175531E2BDF18F7B89AE14CF52BF7F546B3B5076B87080096D5C15558B9BD16A44585C0C0171C54
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........n%.B.KMB.KMB.KM..LLC.KM..ML@.KM..HLP.KM..NL..KMsS.M@.KM.zOLS.KM.zHLZ.KM.zNL..KM..OLc.KM..JLi.KMB.JM/.KM.zBLr.KM.zKLC.KM.z.MC.KMB..My.KM.zILC.KMRichB.KM........PE..L...b..d...........!................oG...............................................E....@.........................`...T............@..(...........H....c...0..........T...................@.......h...@............................................text............................... ..`.rdata..j...........................@..@.data....\....... ..................@....rsrc...(....@......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_am.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.850152460164065
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FR/vRi4k4+R2T35Jy0Wp2xPxh8E9VF0Nyme:FlIZJQy0WsxPxWEc
                                                                                                                                                                                                                                            MD5:72E47A3D3E835B08D1AE65D4F69F77E0
                                                                                                                                                                                                                                            SHA1:7F086000901CF2518C35E1734EA1ED9E10DE369C
                                                                                                                                                                                                                                            SHA-256:FF74207E5107DC2DA38AAA4DE10BC8EA83FAECB2BCA0BF985A7E5A6B427643C0
                                                                                                                                                                                                                                            SHA-512:02124755B52423CF734C6CC28AF44FA7F8DC79EB4E9E475208FB6591AA2317A149B7EFC0E5E7A3DFBAEB9CDEF9ED69084C45DB6221003DE69D6AD1B45B9C09CB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......d...........!.........z............... ............................................@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ar.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42944
                                                                                                                                                                                                                                            Entropy (8bit):4.835542008183028
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FruDM3lkCAu+JGPpHJy0W5m2Pxh8E9VF0NyhAd8:FUSlkCAd2y0WPPxWE7C
                                                                                                                                                                                                                                            MD5:A37370A759932400EED7EAEDDBB482CE
                                                                                                                                                                                                                                            SHA1:638E51217F7DF449D41067AB3135D5912517B858
                                                                                                                                                                                                                                            SHA-256:F183305C17D1C06C3006816E1BAD733599E977C1207332799399CEBCBDC7DF20
                                                                                                                                                                                                                                            SHA-512:9FAD66444C544519FF4898DEE7772923DD0708A27422D02475715E9F1B10C058CBDD8B4C53E8B0E25F7B0CC4B967DD33AD4A36BF21A4099699F87B69FEC4DD97
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...1..d...........!.........v............... ......................................{6....@.............................D....0..(....@..Pm..........H|..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pm...@...n..................@..@.reloc.. ............z..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bg.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.8691314938087595
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FsBzeydckieGZBOcuUFjJy0WgXTPxh8E9VF0Ny6gIBb:FmLVEDNfy0WQPxWEkDR
                                                                                                                                                                                                                                            MD5:01F941A4B83FABF16E5BC21100B69D38
                                                                                                                                                                                                                                            SHA1:AB6E4B97F90CF44CE6463E96FC97BAFBFDD750AC
                                                                                                                                                                                                                                            SHA-256:79E3DA0E23396DABF17FDC7850D84BE5BFC7D6C7E27D6A83EC2DD3537CDE8912
                                                                                                                                                                                                                                            SHA-512:DAAD8ABF022623447EFB08B1B931F52F2328587FE3FED0D510D036E72CC0F293C8584D10F63EF3268768E93C75018CDF4D4128BF863D517B432EB758570C8EA1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_bn.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.936222804071481
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F0aapGvUx7tYF7qWF0FrHF6rjbmBwRbooJy0WNRuyZPxh8E9VF0NykWri:FWsrBF0FrFnBwZy0WT/ZPxWE6
                                                                                                                                                                                                                                            MD5:663E632846D59788FCEB10677488AEBC
                                                                                                                                                                                                                                            SHA1:D55E88C98121FCEFF9D290E48982B7B4F2204BAA
                                                                                                                                                                                                                                            SHA-256:1DFC05748521BCCA9C4BB71E2F02E2FA52B657D0F8DB1747BC9B4B27997A60D6
                                                                                                                                                                                                                                            SHA-512:13F29325EA1C5055B4F344B7B43B52E754D3C1645263F0168F8936D26B98EB5E352E1F1DAFD68E99DC88A6B976A23BD0BA2DC1A73AC27186B8B5F742A18C8C09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...w..d...........!......................... .......................................@....@.............................D....0..(....@...y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ca.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.655403186782661
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FTYiIP42ArzVuJG4bPl7aJy0W3kPxh8E9VF0NyVhQ6:F6Q2ArBuhoy0W0PxWED
                                                                                                                                                                                                                                            MD5:EC63069EFD260AD24F218AE84882F3FF
                                                                                                                                                                                                                                            SHA1:5875DEFDF669CC4747C4F68536E9117DE2BD4A53
                                                                                                                                                                                                                                            SHA-256:BC60127E50FA8E89422966554F1E9319A0E0DD750525812463E0560E48D92FBD
                                                                                                                                                                                                                                            SHA-512:13D4FE8F6227C54EF928CAE48F8B2854218DA04174B60D70BCEE410C248AD2CFA974402093A795AE275C5F4CDCECDD9426B50FCDBC3F0F64B6F0B0D9BB06EA2F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......d...........!......................... ............................................@.............................D....0..(....@..(y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_cs.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.69656607023198
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FAthlsBWpKJkbYAA+fjoDJy0Wim+FPxh8E9VF0Nyy6:Fwb+y0Wt+PxWEs
                                                                                                                                                                                                                                            MD5:0FCE99454CFCC351D251FA0E9EA77840
                                                                                                                                                                                                                                            SHA1:7B9575192E105B4CB724F51238A2E5E956A76425
                                                                                                                                                                                                                                            SHA-256:8DD39E95CD3515398AED12677DB59D71C0773588FF927A6A782A3BEFCF5B1F5D
                                                                                                                                                                                                                                            SHA-512:61AA083B1C5E2EE9DE23C9BB14B25DEB71A3E6F962495542F83F8D068D5046722D287A7EF5247217FA5EA712572B0EEEADC1B2B3263CB70C061648FED030CEC2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......d...........!.........~............... .......................................5....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_da.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.656501839350111
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FIq7uqfNnwtpY6PSKpJy0W/s0UEjPxh8E9VF0NykMR3nD:FLHnwkOdy0W0lEjPxWEqq3D
                                                                                                                                                                                                                                            MD5:D6F44DC235F838BF4E52165182FC0969
                                                                                                                                                                                                                                            SHA1:1EAAD935A6FF147ACBB041397B9E9D63B0EE1270
                                                                                                                                                                                                                                            SHA-256:8883FD2E7810EB9C4DA66888BC548074FE990AE652CE59A053CBD25E39AE08DB
                                                                                                                                                                                                                                            SHA-512:20792C1D1E1C174EB86F72BA92F83A92C025DEBF68DB2BA9E3C9346FE4ECCEAFE0F94BE62706CB8D16F8A6529A9358A4FC8A189B22178E501B654A1D4F6952A8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...a..d...........!.........~............... .......................................D....@.............................D....0..(....@..Hu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_de.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47080
                                                                                                                                                                                                                                            Entropy (8bit):4.647516797051505
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FjmAR6HUj8gtdF0Me39ADEZoJy0WwymPxh8E9VF0NyaBB:F6ojeMe39APy0WwPxWEc
                                                                                                                                                                                                                                            MD5:42B89B0A42B907D63FE680AEDD8B32C7
                                                                                                                                                                                                                                            SHA1:2B36C8BD041331D835DD897AD5FFD29E41ABC52C
                                                                                                                                                                                                                                            SHA-256:E1B6FA1ADC79ADD6CE803DFAF4CE5D5E4DB70EED08223C4EAA381CF0EF55C62A
                                                                                                                                                                                                                                            SHA-512:539D3B51BF450BFB80FD90D52E8A8C2BE077ED39F3E3657FA21DE4B65E391144AFB80CE6C57AEF340EC67821EBA3A886B2E072F7D64152119187ED374B5A73C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................_.....@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_el.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.945276126044921
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fkwaa8EpeILkSIrGCSqlIxRFiAhAu8zBdfsBsTbV234sJy0WRiDEPxh8E9VF0Nyg:FgCplLO+R5U/+y0WoDEPxWE1
                                                                                                                                                                                                                                            MD5:CB574CC86D8FD65185E9C93547D9B98C
                                                                                                                                                                                                                                            SHA1:1271590C4BDED66D5179B1820E9F66C243DEBCDE
                                                                                                                                                                                                                                            SHA-256:7AD4C02B86EFEAC6E068CB0A47D50FD305C2306D71D1BB9812BE9F712597FBDF
                                                                                                                                                                                                                                            SHA-512:E170E7A987646CFC71D9A18FF7119DAEA7AD9C57040C4BD131F86499F663328E9A82240F130699AC10F9D2DDC04154C6D2661A32D768E98B40A0472698E31C3F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... .......................................X....@.............................D....0..(....@...{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en-GB.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.636317941438334
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FR/vElagyh6QuXCA702Jy0WEwRPxh8E9VF0Ny9+W+Eh:F9gagyhiX9y0WFRPxWEjaE
                                                                                                                                                                                                                                            MD5:D73F4E5F97B987B8CC6403909C3E6242
                                                                                                                                                                                                                                            SHA1:0A7075A927333557161BCDE22D08C35FF7636425
                                                                                                                                                                                                                                            SHA-256:30CD762237C21B6FBA4E0B165EBAB83A997C093BB088A3DF56CEE400F5946439
                                                                                                                                                                                                                                            SHA-512:F7B561BCA0F7DBA8BEB19EA4E2B041766FCEBB940776ABD4C79E561ED0997E6D8E3F27927E5DAB6F03CD45ECEFB568BD872DC67F456BF19881546B51DE955B13
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ......................................L.....@.............................G....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_en.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.6565699525229025
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FbRnyUEagyWmpRjy+Jy0WXyDPxh8E9VF0NyYIm9:FbE5agyWqby0WGPxWEm
                                                                                                                                                                                                                                            MD5:2059F62477F33F9943DCE5DB380F09A1
                                                                                                                                                                                                                                            SHA1:62300C5FA2465D535D77B9D378BE7039CE32A234
                                                                                                                                                                                                                                            SHA-256:CA0F11FE6BCD7CBD9897F73A0B5208C49779B298A2DF260CE084912AE73E5C66
                                                                                                                                                                                                                                            SHA-512:AEC61BB34B79A6666E8EAF56372D049F184F02894B8425FAADAB9C4A2E812BFECF250FE561CB92FED2F3B965735BC2E7E97904C2667241A840611C0F4E0C768F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...L.d...........!.........z............... ............................................@.............................D....0..(....@...q..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es-419.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.646030612051221
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FI4fk8AqfN4imEDMaJy0WG6sPxh8E9VF0Ny2C4:Fdk8TfN40xy0WiPxWEIv
                                                                                                                                                                                                                                            MD5:E4A1B678F8B6FAB9034EC4657F1D264C
                                                                                                                                                                                                                                            SHA1:4ACCEDA598F41B7FED6EC58E65121D0A37256638
                                                                                                                                                                                                                                            SHA-256:FAF3E79C113E5423DC0C2308FEEA2B1F1D8A5AFA1BB2D9AFCF4684DAF4B6CA95
                                                                                                                                                                                                                                            SHA-512:2F0E1015224B255535ECBC3691E4F96A6885DC59CDDFBADCA160DA9A45C6BEF2C24AFB6FB3057FE7144E739AAB54F6BAB936A9EA59450411B8E02B318E495B3F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...5.d...........!......................... .......................................2....@.............................H....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_es.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47080
                                                                                                                                                                                                                                            Entropy (8bit):4.630177626115215
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FwNCID1Nz518DNQJy0WEnKPxh8E9VF0NyON:FbIxNN1SAy0WlPxWEo
                                                                                                                                                                                                                                            MD5:5F9A8F94E5B85C41CD81F88119D04F30
                                                                                                                                                                                                                                            SHA1:D5DAC5F57002A1B43B0A83EADC9D2627492505B8
                                                                                                                                                                                                                                            SHA-256:AC2418963CA15734DE3135131C1BDA03D7E602034DFCA75F8D11BCA47B577AB9
                                                                                                                                                                                                                                            SHA-512:A9BA94B650BFE076584D1F465B293F49C9DDFEF747EF51B728FB4988391874542F8029BF4699B304132C8B96A29F29935A213102F3A8EBD3086C54BE6ED86388
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ...........................................@.............................D....0..(....@..p|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...p|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_et.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.645463686029905
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F3EEy0TbDFbDZETJXTSQ8QjGJy0WizPxh8E9VF0NySS:F9j96dHYy0WWPxWEE
                                                                                                                                                                                                                                            MD5:9BC3B29E68A70E0DA276D2F80D5609DF
                                                                                                                                                                                                                                            SHA1:DA3DA32BCA70E64D461B2B7F25C0FB1B0B4B5A0D
                                                                                                                                                                                                                                            SHA-256:19BA49FA519608B6955018FB8B77E39D1356EB1817A8993622F8565322C14CFA
                                                                                                                                                                                                                                            SHA-512:2781E997A4F3C92DE141F14250098779307513F4E7C4D493F40341B6A4FDF09671E6FC64781D2AF38B5F19FB8CDF9C2EC03A5724B291F8D279FFF952AD3DD3D2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ......................................:.....@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fa.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.845272670813686
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FqrH4OZNIY5pihSQJy0W3ZPxh8E9VF0NyFxn:FO7cy0WJPxWEj
                                                                                                                                                                                                                                            MD5:5089CC134B762C266A2D935DA3C8334A
                                                                                                                                                                                                                                            SHA1:E4D142E7B12A64B396E83698467900209B2345FE
                                                                                                                                                                                                                                            SHA-256:1D68B46775921FDE73E30BD0DEA980CEE5D7ACB191DF2D91E16E934400609B20
                                                                                                                                                                                                                                            SHA-512:3A551EFDCC0C0D221EB8BF883EA5312C77FCAEFED6D1EB412351B63945DE9F905F2968C21DBEAD7634E180742DF668F8D1A5A2DBF1EE2C4102AC51291B7B1C3C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z.d...........!.........z............... .......................................r....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.6596573287160785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FCcrgPnEzPhXY7R799hKh1GAm/RnVJy0WhhHPxh8E9VF0Ny9rrlR:FLinEVmNgiy0WDPxWEvf
                                                                                                                                                                                                                                            MD5:5BAB01B758FCB17579A8AAA3ED7A6787
                                                                                                                                                                                                                                            SHA1:53800C375AA17BB906ECA53548FA70191AF221E8
                                                                                                                                                                                                                                            SHA-256:874E4BD71B4604929D88E50D673D52A1A1BC6AFA78C244DD642BA20F302F3E44
                                                                                                                                                                                                                                            SHA-512:05C5936FE09642E71FF8A8ADE4F4F2283B67E8EA79B58C856008DE14CB7BA1163EDFE54B16E517CFF1354693792627B1CAF45D8F0BE5A3D563B9592A4711D4BF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ......................................3.....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fil.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.640479522161056
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FUJKU7UNPli+B3RVaw7ykIIjyC/zaJy0WLnaPxh8E9VF0Ny4S:F72U9li+B3RVawW3WrSy0WbaPxWEG
                                                                                                                                                                                                                                            MD5:17F5249CFB6519985F90655B8D802117
                                                                                                                                                                                                                                            SHA1:2A09E55A2FD07214DAF47A331B6CDDFEA543141A
                                                                                                                                                                                                                                            SHA-256:2362F65816A9D66D94E1B3B4BCE49D2E967B5C92C9326321107A84AB811ACA1A
                                                                                                                                                                                                                                            SHA-512:0EE92E8D81A4E6988F1D2315D5E2AA78629EE142E38D6F104F5115FD983CC3E98142E88859DBCA879315A6843A8AE65B26C507AC4EF25D3B11293551C0B90DAD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................k.....@.............................E....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_fr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.662517782893104
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FM1NdxA98EoIcpW4xq9aJy0WbiA4Pxh8E9VF0Nyko9hl:FadOaIcNjy0W2tPxWECah
                                                                                                                                                                                                                                            MD5:FA87C9DCCA6C104EF4B31FA398150A98
                                                                                                                                                                                                                                            SHA1:22A7F252994BD2C99ACA4F1C544BA1E88A249F4F
                                                                                                                                                                                                                                            SHA-256:0B5678F58A8F8C8619D0940D981B40971F8B42028EDBB2FA845731C747D3B567
                                                                                                                                                                                                                                            SHA-512:FD918AC8E95A7CB33CFCC141ED25F1D5848497BF3645F912FCDBEA64A1BAD1ABB440248E2F56E1C7D7BA8AFE4D3B44D83FEB8C759970203F5CBA147737F4C3B1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...b.d...........!......................... ......................................<.....@.............................D....0..(....@...{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_gu.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.923122510985089
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F0Uc/d3UTeAV4DzYCQ+fwmkIjkiJy0WpJ84nPxh8E9VF0NyZEdgnV:Fm1UTe7VbRy0WpPxWE/V
                                                                                                                                                                                                                                            MD5:E9C9B0BAA58684779947F9DDAC85E83A
                                                                                                                                                                                                                                            SHA1:FE70F8278CF6594D111BB53E0059F1C023AEDCC0
                                                                                                                                                                                                                                            SHA-256:19154A82982A69B588B8A89AC086E80E515B05704899E1B8CA7AF3DE460568F5
                                                                                                                                                                                                                                            SHA-512:41A03F1FA4242E5297F3D4FD18911B64AB1D31E529C964A7A5327E3B8C1389BD1F9CE4EA5A444D64B36808D908BF663235DA81BECA3145049257E258E483FBA8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................B.....@.............................D....0..(....@..8z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.8817065986468595
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Fc6qx6AN6Aaqxzxm8qRXtpqCGay0WKLPxWEE:Fc6qMX31LPx
                                                                                                                                                                                                                                            MD5:282452593ED4C14AA8AD486698BCBB31
                                                                                                                                                                                                                                            SHA1:8CF912912503649E440E632CEA6B4427A0B1102E
                                                                                                                                                                                                                                            SHA-256:CA151F677D1D9ABC95C708726B3D04C62AC7C7836ED9B875C5B1F7D67BC4F75A
                                                                                                                                                                                                                                            SHA-512:9FC0A8FC7641A104B3976F37421DCBA2083878DA535B3662A6FC1F697CEF5108D1715BA618806CAD4E74B13F2E2AAEA10090937F1BD13CDCBB9D8EF7141CFFE2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.6636431303483
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FZitIPeVOXz19zzMH5KBL/yoiGgJy0WXfjjPxh8E9VF0Ny6/R:F8I+5oL/xwy0WLjPxWEs
                                                                                                                                                                                                                                            MD5:85D54C0B73692E53C5B8657ACD189EF5
                                                                                                                                                                                                                                            SHA1:907D142F69B742F7DE5F8738325C7CAE9CA06ECD
                                                                                                                                                                                                                                            SHA-256:4BAD5B8F0372FC19E9414F997B2CF713D81F48FEC6238CDBEFA65CF138E9F5A9
                                                                                                                                                                                                                                            SHA-512:3B1B2792237EF8F6143644FF54D25E7BC95ABF1C89291B0B1BB16DE4C8CC00B7DCE18510306BC94C19CA2BEB33472CCF4DB2976D508E817F06A695F4FB4F6345
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...K.d...........!......................... ......................................F.....@.............................D....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_hu.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.688666100525905
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:FfG7U7RPX1C2TycfBwGFTbeSTZ46931lBVZpjqAy3FGVsTsy0WMNPxWET:FfG7U791C2TzpwGFTbNZ46d1lBVZ5qAV
                                                                                                                                                                                                                                            MD5:EC0EAC7B38E7B4FB9F4F3E97CED70502
                                                                                                                                                                                                                                            SHA1:8A21DEADB00C4A23ED0EF2728C5EBE6D58D8E93C
                                                                                                                                                                                                                                            SHA-256:D083015F17E68E2304A2F4C9A130BF2891A1B3545DCF35E3E6367276BC8FF1C9
                                                                                                                                                                                                                                            SHA-512:43E7EC301C8E4E7259B6038EC5F17C52C27B64CAC69511B6325B50B949F56A782312D28D7264BF4469D3A48FCB73DE831DE0FB388735E1928774742B0D0E8383
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_id.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.639484979051941
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FpZ0+vL3THRxVkAHqIaHQRf2I95yrUdGqPfpJy0W5C0NnPxh8E9VF0Nyoum:FEWfqgbfzy0WnnPxWE+L
                                                                                                                                                                                                                                            MD5:351FAB792600FABBB172E0EB3308A6CD
                                                                                                                                                                                                                                            SHA1:A9BD979F85AC2EE04B63A6F0A266EFA64318207A
                                                                                                                                                                                                                                            SHA-256:FCF17CCCBD9988C121B3754DE7234B3041B7FE83C763A364AFD043297C780745
                                                                                                                                                                                                                                            SHA-512:1C3F626FEF266DA6E8FA5737ECA5CF089150C7CCE2B990ED9F75B2757B509CCB0D15DD38B8CCFB05403C35DDD24745A2105D098B4855E951F987EAD934FC2552
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ............................................@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_is.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.658477005342536
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FOKL63eZkioif2lIPaAjYkUVQFoMUefV3PONJy0WBDPxh8E9VF0Ny6xL3:FouyibAIibkUVQF5UefV3iy0WFPxWEU
                                                                                                                                                                                                                                            MD5:85BCF7664BAE9ECB72C8480214FAE669
                                                                                                                                                                                                                                            SHA1:172FFCD25B4956AB674C008BA1BC6796FDBA11DF
                                                                                                                                                                                                                                            SHA-256:45F41E8D25867AB8C2EF78B866FBED4A201CD451713AEFED27A1E6C4E550FE88
                                                                                                                                                                                                                                            SHA-512:5A92ED998134963A7B76B44A5C6CA8F248BDBB13AFADDC72A5AD1915EC22C98415387295AE2E08209E1BFD866EF878BBBCCF9759C4442DB98340DFB6345B77E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...4.d...........!.........~............... ......................................%L....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_it.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.6324666300251005
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FLEXOjrIN+sah3MO/Jy0Wt9zIjoCPxh8E9VF0NyTKF8b:Fq2IN+P3Jy0WzI/PxWENw+
                                                                                                                                                                                                                                            MD5:B85708D2C23D44CAC26488C1ADCD676E
                                                                                                                                                                                                                                            SHA1:195D94B76B8D31976ED804DC79ECEE120BCCF6D3
                                                                                                                                                                                                                                            SHA-256:DF621055A085663B147DBFD1F54961A7F4299E7714A69541CAC6E2A8DB17CDA4
                                                                                                                                                                                                                                            SHA-512:83CBACA8F28F4855685365477B008993F00477C006B931B6413BA4FCDE89010B8BDFD0F4DBEEBF864802931BC95CFBDE7DF3D17CAB40D45661AF0B15143D78AC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ...........................................@.............................D....0..(....@..Pz..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pz...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_iw.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42432
                                                                                                                                                                                                                                            Entropy (8bit):4.854173056599383
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FB3XBjD2r9v7hdVexaDyQa/f8sS+9GmJy0WJd1w4DPxh8E9VF0NyYok7o:FCFNMrSQy0WTZPxWEym
                                                                                                                                                                                                                                            MD5:05AAEE6122E3534C4ABF3B3D95E6EAAA
                                                                                                                                                                                                                                            SHA1:D17CEECA35099A36BD99CC017A603B4F486D9FE0
                                                                                                                                                                                                                                            SHA-256:C7292A8852AF042741E768702611672C3CB51E6291A3856249FF240CF5D238A4
                                                                                                                                                                                                                                            SHA-512:A58EB20DDCE03517804A80C536DDBD7866263A68D362AEBC9F7991B81ADF62069CBD39582A88F06F125DBC666EA5CA07C95CA36763B72FE22C6784A64F9CD8EC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z.d...........!.........t............... ......................................H.....@.............................D....0..(....@..@k..........Hz..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@k...@...l..................@..@.reloc.. ............x..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ja.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):41408
                                                                                                                                                                                                                                            Entropy (8bit):4.883723947959775
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F/RouMWEHjkgWDMNGJy0WUqcPxh8E9VF0Ny1nB:F9HEDkgWiey0WkPxWEXB
                                                                                                                                                                                                                                            MD5:F88EF38633AF35044AD10C3400990BC1
                                                                                                                                                                                                                                            SHA1:B605DA6DB49B5C7648912DBBDC17CD0CC70D7B11
                                                                                                                                                                                                                                            SHA-256:9975AE9DF9F8B81C50DCCD0E95D5AAF279F7991071D09E05DC9F622E5497EEF8
                                                                                                                                                                                                                                            SHA-512:D7BE229D8E65A47CF119AF62FDB6720D6A2C9263AC69B6AFA3FADB1BD79EC273D4B0842C73722B629BED0204558933BB108C1A156478E485A5304B39A9EDDAC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........p............... ......................................F.....@.............................D....0..(....@...f..........Hv..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....f...@...h..................@..@.reloc.. ............t..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_kn.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.954692594620765
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FQdMeRW2As8RBSBRPfetJy0WYhupRPxh8E9VF0NyHZ1GF:FX/swkOXy0W+YPxWElrG
                                                                                                                                                                                                                                            MD5:56A3857ADD97B0AB7C19D551028545C2
                                                                                                                                                                                                                                            SHA1:10F0A5B7A2FBE9221C133529B8A5E0B36B421C4A
                                                                                                                                                                                                                                            SHA-256:30B0A74E6F825986E8794911FCFCDA4131B505BB0B5E93BECB098CC1BBEE8D1F
                                                                                                                                                                                                                                            SHA-512:83C846FA62A0AB70AB07B57927F4F53305949A14E942DB8398E6C90769B47894BC9BCB4E3FB9748173A492C43FF5849E4CAF59FD5242757C0DCF7664EB05E522
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................L.....@.............................D....0..(....@..P{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...P{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ko.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40896
                                                                                                                                                                                                                                            Entropy (8bit):4.911833136088746
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FCJcEWZFDd4IY+N1vZsYoRHgA12MrlxB4xRkkTY1M5tkOe+VjJy0W7VPxh8E9VF4:FUlWXmmAq/jveoy0WxPxWEu
                                                                                                                                                                                                                                            MD5:16454F5496343F3383905BEAD12F3388
                                                                                                                                                                                                                                            SHA1:1F38F482A2957A5E19BCA744C13A8931E4AB73D7
                                                                                                                                                                                                                                            SHA-256:4ADDF9F4A52596B37878C3CDEC55F962632272E6C81E4BE75F52C824CBAA840D
                                                                                                                                                                                                                                            SHA-512:4D77D9102583AB084BD7BEE4345202CCA3F7AD1D9A307BB4486A38ACFDAE4F878908E411E1FC92B3CE08F284E3BD8C6DBF321A8F19592ECA7CBD257C413139C8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...e.d...........!.........n............... ...........................................@.............................D....0..(....@..0d..........Ht..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0d...@...f..................@..@.reloc.. ............r..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lt.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.677692678096642
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FGqI1qXnc9eHz0CwTF1B+jF2Xw1KJy0WFEPxh8E9VF0NyO/dz:FOackHz05TF1YjFmy0WuPxWE4F
                                                                                                                                                                                                                                            MD5:E0DA28606791E47FA9B7D50F3637FA65
                                                                                                                                                                                                                                            SHA1:00DF626C1C14D57DC0AB1EFCCFC3CA0B700F3F26
                                                                                                                                                                                                                                            SHA-256:FB4C1B85935F88E2215CCA897993AFDE01740A36429B1D515905AD42A5F9FA5C
                                                                                                                                                                                                                                            SHA-512:9795261821859668D22D63086EC0A6D034043859229138B7899A862DDD6317754479B5D53ABC24895BF91A4370C4648EA9CBED1858E4F44992C6C498090DB1C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... .......................................A....@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_lv.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.703009692113209
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F4sqvepyAxOeKdeccQJy0WZy8Pxh8E9VF0NyISi:Fw8fey0W08PxWECz
                                                                                                                                                                                                                                            MD5:C8802E1E924F5CA936D967BE9FA5DA69
                                                                                                                                                                                                                                            SHA1:31FC7A8BCE71548AA52D0BBB877416BD3B647D98
                                                                                                                                                                                                                                            SHA-256:92CEC5B3CF76DBA98E62A750EACDEE2BC871364133A4C76CDB1E8AEFCB702BC0
                                                                                                                                                                                                                                            SHA-512:4289AAC7A6B5AC3EC0BC767612965D9F9386C832B6F98D44D245CB45D6239C620E7FFC0EBD47793C9014CBAB9B0BD56A6467191806841DA17059C3FE45E2F217
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ml.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):48136
                                                                                                                                                                                                                                            Entropy (8bit):4.926909967496055
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F/TZz4S1BzFZygd8/JLosSJy0WucSjPxh8E9VF0NynYWq:FrR4ISJLgy0W/SjPxWEFY
                                                                                                                                                                                                                                            MD5:16F9F18C873FB7C00F08917F1AF83EB3
                                                                                                                                                                                                                                            SHA1:0FB99CC388FE54D5AA875F79E65A0A73E99D9323
                                                                                                                                                                                                                                            SHA-256:E6F74C212F2E8EB4163C2DDAE84F488B73DEF9CE886340F4A9AF6864978D859E
                                                                                                                                                                                                                                            SHA-512:799209ABEC146B52F3EB5C4D5AFC3DC6482A3B0CFB21C1F1F876BD87D1014E7079AE694C12A80D4660063D9C3D309E9028B4A90887572BCB848B5ABC21AB7317
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...l.d...........!......................... ......................................[.....@.............................D....0..(....@..8...........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8....@......................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_mr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.898551846960824
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Flbeoedw/7JK7bABYlNpJy0WfWPxh8E9VF0Nyq4D:FAlw/7JK7b9jy0WePxWEU6
                                                                                                                                                                                                                                            MD5:B44F9C9DCB53514D6A496C3506F74DBB
                                                                                                                                                                                                                                            SHA1:1DC610693F782D08E3D6985351C298A61AE40614
                                                                                                                                                                                                                                            SHA-256:430FEF5E3BC821188BFC9A180334495B92CB0E8D8C7FA0CED774031D9A7FC8B6
                                                                                                                                                                                                                                            SHA-512:B7C9E4F838BFEF2B781D3871455D7B850135B8FF97FC1968E49BC2AC0B0B1F33DA759AD34F8E43D858A0971F8C2DDCA51925A5A65061E5B90DC4505405DC5748
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... .......................................8....@.............................D....0..(....@..Hy..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hy...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ms.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.652027629630858
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F546L/TKrQLtUv6oNpaAYjZZ/fbMgTRlRE/5nJy0W8g/Pxh8E9VF0NyNDA/XV5:FVw+f3TFAy0WH/PxWEXDiL
                                                                                                                                                                                                                                            MD5:8E1DC4C71BC03D10ED3BD2293B6C3A21
                                                                                                                                                                                                                                            SHA1:6649BCDF0D137AFFA4CA983135FE5EBE3336A495
                                                                                                                                                                                                                                            SHA-256:0C0B827C7ED352F5FC376B3F2F2064CA7A27828907BE77C66585CC457A769F16
                                                                                                                                                                                                                                            SHA-512:AB785D0FFA1F7FA7754254905752366B9BE7B592248DFCF036B087A2EAD07E112228B4D36B954DAEFF2ADB24A0566A9552168BC3FE7FCC5E4DF0E56A95B8042D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ......................................7"....@.............................D....0..(....@..ps..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...ps...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_nl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.64263735417891
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FUdjv7nGXd/T32SPxLLJy0WGT1+Pxh8E9VF0NyazyEH70:FwGtKqNy0Ww1+PxWEU
                                                                                                                                                                                                                                            MD5:9DAD72B74700EEE3D33603BFFF9E1F98
                                                                                                                                                                                                                                            SHA1:5C9DE57CFD021549D6B34AE225E44BF0BFD662CB
                                                                                                                                                                                                                                            SHA-256:6BDEF62FBFEB7B054E17F463C24A878F537EFFC82F8E3CF96D977265E44F2659
                                                                                                                                                                                                                                            SHA-512:DDF30DD81788173FB0332B548C40A03B9BBD1B32074C54C36150D7AD64AA7DF5974A8FE6D2155E17E22A505F66DFC54147E7B9F88B644EC0F573ACBCB61992CE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...[.d...........!......................... ............................................@.............................D....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_no.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.660574455025035
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fio75JZSiyCSiyVKwRAYSTv4q6K3Q5PacJy0WlxjPxh8E9VF0NytvuLK:FWhCYWv6K3Qby0WbjPxWEHGLK
                                                                                                                                                                                                                                            MD5:EE0889163C7A670DD81A3E05D52EE458
                                                                                                                                                                                                                                            SHA1:A7A834305FAC8F75B1556234F5C0381623B29984
                                                                                                                                                                                                                                            SHA-256:E1960E7A05427B85D79F60F8A163A68CC29C6011A87521DCDC00B1F1A3D8B606
                                                                                                                                                                                                                                            SHA-512:679C4163ECE96C888D3B72926A1BD710C444A07290E60DEB274A7426B7850826650F3CAEF4338639881526F1C7FE179C12AF671C13BF24BB5E67052B37F23D88
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... .......................................}....@.............................D....0..(....@..Pu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.699948735964885
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FuwzJhn7KZHCCN08Gp6WDgxTJy0WppKPxh8E9VF0NyKNky:Fb7y3+yHy0WqPxWE8a
                                                                                                                                                                                                                                            MD5:4C826E19B27FC31A8141C1735A3A093C
                                                                                                                                                                                                                                            SHA1:E74FA47D26AB8A2C45E6DB2DB94E27FB84FA6437
                                                                                                                                                                                                                                            SHA-256:421DDAAB31E480790E5989E145C050010959E629702E3187870C12E451278A92
                                                                                                                                                                                                                                            SHA-512:0AC44BD5A24B05D49B08ADFCD53C7C5A45D97E8798A854AFDF9BF374438F657C56255C690BDF0837EA154ACB71DF83D0DF1491DEC7D5D4DFB9FE272AB507C593
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@..(w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-BR.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.66752824702996
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FGTbq/Zc+GZX8aF8zQJy0WCJ65Pxh8E9VF0NyL5:FuCFSy0Wk65PxWEd
                                                                                                                                                                                                                                            MD5:C5DA26E0E296C4C1666BF60B0CE16911
                                                                                                                                                                                                                                            SHA1:93D4C57699BF8AA981E3EBF8B33992F2CA45DE75
                                                                                                                                                                                                                                            SHA-256:5A04FEA91640E065F67F1427F171270CE769CB3E2155F340834C935783AAC634
                                                                                                                                                                                                                                            SHA-512:E6175D639071FD13F00ABB0C2B1876387899158CB824182783710C1177E18B5E02B18B70C0CE91F32F1367F8CA5C92F1E8D1F98BA6918D7312BD6ADE56D9FABC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...O.d...........!.........~............... ......................................-C....@.............................G....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_pt-PT.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.646340111209961
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FVEK+wstFNEx6ewBIiI2XhJy0WQGSPxh8E9VF0NyC2nEm:FVUMx/ULry0W0PxWE88N
                                                                                                                                                                                                                                            MD5:1ADDBCF6719F81E880737EF30CA89BE5
                                                                                                                                                                                                                                            SHA1:043C046AA3420339067C6DDFFBA253393057B0A3
                                                                                                                                                                                                                                            SHA-256:9E229B99EC1725BA355B7F905A46BD4C7D15DAE3A7FA5CF54A8C199B6BB572BE
                                                                                                                                                                                                                                            SHA-512:6931634D5096C236930FD4CA3C850D9DA325010DE96D99A7C26EEB9E7153DA7F4D3203F7D332820DE5F4D045296CDDBF9890EB6D157E27E82C46AA098EB6ECF7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................Da....@.............................G....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ro.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.668533720243672
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:FTnC1yNbMUB251BRHc871nDtCsy0WK4PxWEr:FTeBRHnRDLJ4Px
                                                                                                                                                                                                                                            MD5:0802BEFFB8CC1942F450403A83DAD91A
                                                                                                                                                                                                                                            SHA1:6BFE6CFCFDB789FE15365AD39AC60D7CFA782C31
                                                                                                                                                                                                                                            SHA-256:A15770A440E09967BBB25E4B8B326AE2596DD80F483CE12AA21678D0DBAD9233
                                                                                                                                                                                                                                            SHA-512:6F960C168536251F871F1FD3EB6E62AEA407DF0FE3218EBCEBEEE2CD5B3DE0675CDD874253F3259776B9338FFB9B6B4C608E769E21F9847C25600E3769B303BC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ru.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.876003031420293
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fm5y4uF44vKAvHdho4d283lmJy0WR22dPxh8E9VF0Nyvdz:FtZvHsFy0WnPxWEJ
                                                                                                                                                                                                                                            MD5:722B3E9E83D16481C12B803537F72AF3
                                                                                                                                                                                                                                            SHA1:D245E7A40305CFCA26A9EE4B95CB7C1859EBBDB8
                                                                                                                                                                                                                                            SHA-256:F44BBD97D7B300262AB1F9D4C918B3B980D41419E91669B04E36756A5683974D
                                                                                                                                                                                                                                            SHA-512:4A5A6DCF554C97885DA2632850CE380A7371264F78D0E268E34690E6820CDC2B7B671F7055709DD92A77291FF618FC9619308B89D4D7920F46CBFDE284FB00AA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...9.d...........!.........|............... ......................................GM....@.............................D....0..(....@..xs..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xs...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sk.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.69456859037089
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FpXaHdicuh+PiR6gLTPB2wJy0WELPxh8E9VF0Nysz9:FpQqjRjJy0WKPxWEy
                                                                                                                                                                                                                                            MD5:F8796BBEE22813BE0658163260FADA1B
                                                                                                                                                                                                                                            SHA1:F0AD54100A996E41011D9FFBE084CE7681299C9E
                                                                                                                                                                                                                                            SHA-256:8EE1C8984C63767959CD2ABC99BDBD860DA47B9D4B762982E045764F2FF56FE0
                                                                                                                                                                                                                                            SHA-512:8D9D3168D4D4A7E50AB856D3BB87CDABA5609B809BF0BDB9BFF00D7FD925B4AB750FA19DD9FD44131B46C72F87852D1FFC76144DF3F3CA450A0E173BFCB3C76D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@.. u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.657549160186828
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FuqToeST0shVyixlk5TpWBdf1i2IXouscM89Jy0WrTpKPxh8E9VF0Ny2WW:Fhv4lk5y1YZsAy0W0PxWEYP
                                                                                                                                                                                                                                            MD5:A7B4B48A39BFD0C344FE3D41545B76C9
                                                                                                                                                                                                                                            SHA1:B28B71015E1A3710F1C042291D398C6119FD48A7
                                                                                                                                                                                                                                            SHA-256:C828237E6C4C8623F1F2E9598A62936769355EE7BEA317460CE645CC7AF1D911
                                                                                                                                                                                                                                            SHA-512:1D15AA6913E32D7200055F8B29ADD8E5A2C4A9070B9CD906788E4DBCC5F5BD5FBC14E47805A051569AE51792C0065F8ED6F9414E968D466418B10056C0A541DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................V_....@.............................D....0..(....@..pv..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...pv...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.872942179610346
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FWPbqSW7ixHUjY13tGPJzJy0WEtqkPxh8E9VF0NyBF:FKqOUjudGHy0WwPxWEb
                                                                                                                                                                                                                                            MD5:799B04C0C9700BAED67AE3AF641B8946
                                                                                                                                                                                                                                            SHA1:25050A1D302F6F3BAB291FAF07C7AFB147BD6992
                                                                                                                                                                                                                                            SHA-256:A77EC067351FEEB80B8F8375C98F993360CB52B7C5F90DA90A8C9A08CD544E5F
                                                                                                                                                                                                                                            SHA-512:D3D15D4BB99EB167040A319BA56797F718DA3FAB1CDF131E290F5A9A03876C9F41705820EC52E55686DE7FD5B1969ED7896888A2358FD41DB3588EBB63ECD58D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...K.d...........!.........~............... ......................................L.....@.............................D....0..(....@..Xu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sv.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.664578663662526
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F9a0GdxC7vc3ELOlJy0WcCDJjZ2Pxh8E9VF0NyP+/o:FRAxCDc3Eyy0WsPxWE9c
                                                                                                                                                                                                                                            MD5:CA50F99E4418798ADDA414C81118C2B5
                                                                                                                                                                                                                                            SHA1:2F24E7B5C81DF67236C1A692E3FF4091D10907F5
                                                                                                                                                                                                                                            SHA-256:C055262DE24BBC07462232258CB082C6E6D5FF1502CE2909B9CDA46CD27ABF75
                                                                                                                                                                                                                                            SHA-512:83C199505517CCA36FB86066C73DAF9C35611A5E58EEAD3F49AFF1631DEEB188CCBE7B671439CACC0904B3CDF9A7C8EAAE0CE371AFE14F4ADFD5D042D31D2C7A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_sw.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.694492393037756
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FnHdpqgicgiY7upv4M5IOyAeJy0WXaQPxh8E9VF0Nyz1R2:F9QQ07Gv4M5My0WJPxWEh10
                                                                                                                                                                                                                                            MD5:1DC167C856FE15596A907B56A5451F38
                                                                                                                                                                                                                                            SHA1:6803F563B7F78C6D7133FC1D2C6126EEA1D9FEBF
                                                                                                                                                                                                                                            SHA-256:E31B4E78C820A17124669D3A2B56C2373FD2C21BC5F0E87565C0AE8B5307E236
                                                                                                                                                                                                                                            SHA-512:18FDE8537E95411C9814DB12E780CA7AD4E6756A97F2CE05CC30653E2C4F3735BD09AF6D2F9C23BC6ED5DB09231D8070E1025738B8C0B32214E217CBCD250A13
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... .......................................F....@.............................D....0..(....@...z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ta.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47080
                                                                                                                                                                                                                                            Entropy (8bit):4.948448659499415
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fd08e0wcY51ZLm+4Lw3OTJJy0Wn+EsCLePxh8E9VF0NyK9Qm:FX5fY51ZLm+4Lw3wy0WXs+ePxWE8p
                                                                                                                                                                                                                                            MD5:F2827506727689200C75B134AF3A81B7
                                                                                                                                                                                                                                            SHA1:701B606A684B30BFA376F4F244582FF32BB9E6CF
                                                                                                                                                                                                                                            SHA-256:8831BDCD00FE1055E32CED62DBC3437612EE704FD331DF35D8ADF4450C95D3B6
                                                                                                                                                                                                                                            SHA-512:3069C2BFBE34E27A4309843B79585F89C44D0949F1EF51C3FBB79A91310CA8C8C9373E603E356AE1DA575A7D60A056FFAA2742AC356248A30C00BAB02B2AB680
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...4.d...........!......................... .......................................r....@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_te.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.900098776782017
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fxfyhq1o45Z4aJALD61VJy0WVDPxh8E9VF0NyEc:FshGV5yaaLDiy0WFPxWEu
                                                                                                                                                                                                                                            MD5:C6A338676486B4405CBCFFD9E95B6DFA
                                                                                                                                                                                                                                            SHA1:6B7E2FE7EEDB08B289FC4DAB01BFB1EC648EC416
                                                                                                                                                                                                                                            SHA-256:EA52171A1BA9D431C9E4E99DB45EF64D5AAD5C224A80A731BBAC428D626360DC
                                                                                                                                                                                                                                            SHA-512:08C73FB7DAA69E6D7F5E3A23D1D5761EBE158A7863CC754F80EF7CEB57100E2337819F6733203121C85FB898002660298BD8B9221D96E5B1FA3D96CC22D05406
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@..Hz..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hz...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_th.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.898585189301246
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FAcYp+lrGsMKNMAcetNebrJy0Ww+w8Pxh8E9VF0NyHS2t:FaglrGszNMJetNmy0WttPxWEdXt
                                                                                                                                                                                                                                            MD5:921A76FC57260B64D56F85651968A802
                                                                                                                                                                                                                                            SHA1:DE76CBF4AEECB954EB67937D57FEA4D053AAA89B
                                                                                                                                                                                                                                            SHA-256:CE33AD0DBA4BEC40377B9ABFED4EE3C03CF1F159DB500F95366C377F6FE49664
                                                                                                                                                                                                                                            SHA-512:62BC3D4395562561A52E0A387454C631ADDE175AFDDAA3DE6084E0B55D89538AC49D3A7AC04EDDDB1E4013862AF9C3706D40EAF249443598A16B5521852DE00C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z.d...........!.........z............... ......................................#.....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_tr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.710217028647626
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:F0Jp9ABk6qXQEdmvgh57GE+G9Ahrx++BzQSXjy0WebPxWEC8:F0JZhdmva7GESxLQK7fbPxt
                                                                                                                                                                                                                                            MD5:5BA91381EEAE1785BA89FC890808C7A9
                                                                                                                                                                                                                                            SHA1:CE3CD4E4007837F3A8D1629AA9366A0FAF4B2792
                                                                                                                                                                                                                                            SHA-256:B6B7B4A056D3449349BD0981B48AD1DCBC32AA5B41C4FF9B680F994D540744EF
                                                                                                                                                                                                                                            SHA-512:E8325BD2E545D322AD9627F6B631402A3868612B407C4F84CAD0B3C834EA0EA5D4ADF5DD88B7D539BC231B4651A5F2C0BFF1FC1D843005B1C96A56BB249D2DF0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_uk.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.886468370762969
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FNUVbL1KgHWyC2EeEWNXE/GfuyziJy0WlUPxh8E9VF0NyJTgk:Fy31luhy0W+PxWEH8k
                                                                                                                                                                                                                                            MD5:65C37B9914F7786AC7E3C3584C8F7A62
                                                                                                                                                                                                                                            SHA1:3B2D785698F96CC92A6AF481283406657FFF65E0
                                                                                                                                                                                                                                            SHA-256:9945A40CD5E0075A55A6691717D8A59C98BD85AE84E938041DD6EF5427A88B0A
                                                                                                                                                                                                                                            SHA-512:5005A480EA3243F8232B44BA091A66227AC10CA51219B9915923B7C394538BD498B33062C1E88316BBD84CEBBCDEF80B901014A8A595DED29BDDDF2F85904308
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ............................................@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_ur.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.8564330106913625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FmQE7wL2A+OmAcoWu9OeeZyYGdJAAJy0W5ySxPxh8E9VF0NyVQcVfC:FkE2A+OmAcoWAOeesYRQy0Wg+PxWEXV
                                                                                                                                                                                                                                            MD5:CBAFB9B9B8760B0C3DBC3F0216C7513A
                                                                                                                                                                                                                                            SHA1:0A28C2BC915B06C549DDADD8A31FE0A912090155
                                                                                                                                                                                                                                            SHA-256:5E7C4916662FED930983ED046FF7DEF877F10D5375C510653C37A985BC547531
                                                                                                                                                                                                                                            SHA-512:5FE40E9A820C46055B0E9934C5A8BC2E43BE90396436CD076752696C8576E2212D0A5D15F4C149866FC68500410727C1D30A6F1EF55ABDC0CF96DEA2F2BB3AC8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...f.d...........!.........~............... ...........................................@.............................D....0..(....@.. t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_vi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.771867334398084
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F+SM5fQghFjncDyv4Jy0WAWBQHPxh8E9VF0NyDff1R:FzYfDhVc5y0W3OPxWEh1
                                                                                                                                                                                                                                            MD5:C34505DD2FAE316B795AE2D1E934AFB0
                                                                                                                                                                                                                                            SHA1:864A67B9017573DD438AE321210ED720C454184C
                                                                                                                                                                                                                                            SHA-256:0AF644546C66B952795B0A7D05AFCCFE87E9D572073C99F8CDCF146EE5705857
                                                                                                                                                                                                                                            SHA-512:00B2FDCFE24CD17C7418E471BEC762F235669E0DB35D05D2023E155D0B543F65BA1115450D01FC5D02177AAA2CDAF10CC640506E6CEAB716F0C4F2ED44D7767E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ............................................@.............................D....0..(....@...s..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-CN.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):38816
                                                                                                                                                                                                                                            Entropy (8bit):4.841517965818435
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F5xjPSJshAFBMHwzJy0WKGPxh8E9VF0Ny/NU:FrpAFBTy0WvPxWEJa
                                                                                                                                                                                                                                            MD5:2BE99DBDE29BAB1363E5848B84362E23
                                                                                                                                                                                                                                            SHA1:3149C9598CE3CB29EA0E756C9E12DCECB8628283
                                                                                                                                                                                                                                            SHA-256:B5927FB9699C79D77B1D49F322BACE29801776CCEE4F91EECAE00F04F6431396
                                                                                                                                                                                                                                            SHA-512:44E66C99747F6857883585653894F333B638A4A19AEBD1C9CEF6D264064EFAFD7A77FDED06F5F5C14F0E489E2555D17576EE3152E347CC74B8BC7E5741F3A5A8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........f............... ......................................c.....@.............................G....0..(....@..`]..........Hl..X+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...`]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\goopdateres_zh-TW.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):38816
                                                                                                                                                                                                                                            Entropy (8bit):4.854603942594096
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F++/JutGmmBdcJy0WsinPxh8E9VF0NygBjY:FNATy0WjnPxWEKK
                                                                                                                                                                                                                                            MD5:2667B44345F8C493F41C9C65B2B40B70
                                                                                                                                                                                                                                            SHA1:0969DC5411520E3FDC242D6D1F5289DC69218526
                                                                                                                                                                                                                                            SHA-256:3BEE374E97F8C0A2EDA5A6509CBFE21B4DC3BB9E0CAC62CA908F8EB049A3EFEC
                                                                                                                                                                                                                                            SHA-512:8D746F5AA6A21EC1FBB05E35554396BCD0E017CED7D65409D721B75CC4DB04FE7FA944F4122C1BE1E6AEF47E1DEADDF444A943BF9D5632E906BE123013B85ECA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...P..d...........!.........f............... ............................................@.............................G....0..(....@...]..........Hl..X+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\npNortonBrowserUpdate3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):519152
                                                                                                                                                                                                                                            Entropy (8bit):6.796206581178465
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:bcP2nPG96akIIm7D0W1IK+K2XaTPwKwJIC:AP2n+96WD0vWoaTYKwJ
                                                                                                                                                                                                                                            MD5:6B3F50DD9E9D077CD50902BF1B79427C
                                                                                                                                                                                                                                            SHA1:32B57A6452CABF75DC4162EE026D396A13933955
                                                                                                                                                                                                                                            SHA-256:9CC9D08D8E71D15E15D32B2A5DE58766A7DBFFEA37F476A739A42231C26A2777
                                                                                                                                                                                                                                            SHA-512:5856C0B791F93E4DB5C0950568C45BCC3D132466661B7A9C1B85C21ADBEA91EB5C9744E67F5CF2877F934DA3C278550D7FDE294A6CAEAFC634CBCE71DBA40EC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........iI..'...'...'..}"...'.rx ...'.rx!...'.rx$...'.rx".Z.'..T...'..}#...'..}$...'..}"...'.rx#...'.rx&...'...&...'..}....'..}'...'..}...'..}%...'.Rich..'.........................PE..L......d...........!....."..........[........@............................... ............@..........................=.......>..........h...........H....;......8I...&..T...................@(......H'..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data....I...`.......8..............@....rsrc...h............J..............@..@.reloc..8I.......J...f..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\psmachine.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):396216
                                                                                                                                                                                                                                            Entropy (8bit):6.6364472604888975
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:n4bSrQpVFWtouGV7AstKS4rHICzoHz25HxPqJKCJAOFbr0uY6ckgOdi:qSUpVF64XsS4rHIC7qVJz0eHLi
                                                                                                                                                                                                                                            MD5:8648A09E9EB09453D7153101E25F8FCE
                                                                                                                                                                                                                                            SHA1:B55B5E28317A5F1452BCBAC2704747B3DC4483D3
                                                                                                                                                                                                                                            SHA-256:BE8DB74FBEF1CD2EEE7C2A8957B33634913EEA9CBD20B1E875B95878BBFBC42A
                                                                                                                                                                                                                                            SHA-512:57BFF27A142062691507B1D99AB8086FACEFC3A211484B97281964F615F2C5259760622FA83155F4198BB48E3D2B54795B4E316D9156C293939D318ED959CDC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L......d...........!.........................................................0.......[....@.........................P3.......4...........V..........H...p7......L5......T...................@.......h...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\psmachine_64.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):521784
                                                                                                                                                                                                                                            Entropy (8bit):6.353157166068969
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:lcYznGwe1OMgciIogFK/IMakdTv4aU5i2s1uEn0ToohzmVj50ZfxA6ckV:bnSgciKFK/IMakZvvClDE0TooU10xH
                                                                                                                                                                                                                                            MD5:29991826BE3385C3A92B49F672F92026
                                                                                                                                                                                                                                            SHA1:9F16C72BA044E378167F631C41CE1B3D818E0806
                                                                                                                                                                                                                                            SHA-256:7FCEBD4FF83566305500F9BFDD342EB57C502B427A12EF281092FAB94E142827
                                                                                                                                                                                                                                            SHA-512:F525CDF3EA0B77CCA0475433E6DF3A577F76479C0B6BECCC0B41A147D9372A4BA8586D84FB0ADC5660A4BC28359DACCBE76691C604748AC56991210E344D748F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d...M..d.........." ................(........................................0............`.........................................`....................V...`...9..H....;......(......T.......................(...P...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata..Z....0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............J..............@..@.rsrc....V.......X...L..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\psuser.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):396216
                                                                                                                                                                                                                                            Entropy (8bit):6.636012823818412
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:S4bSrQpVFWtouGV7AstyS4rHICzoHz25HxPqJK7JAOY1r0Oc6cOgOdi:dSUpVF64XMS4rHIC7qIJW0ypLi
                                                                                                                                                                                                                                            MD5:737520D5A13D92E1210CBFFFC64C109D
                                                                                                                                                                                                                                            SHA1:F6677A3AA960225DBE682678289FBFFE4AF3C9CC
                                                                                                                                                                                                                                            SHA-256:6A59B47E916C73C046D604956A050CC5AF9A0C96D1DAE51CD8ABDEE17F273085
                                                                                                                                                                                                                                            SHA-512:89BD770D565553ADA2123CAFDBCB3443E5B304BF0D0EE901CE2DE0E7C6245B08162F2FE39C7FCFC1A7908105A3A00DF3BD8DD3EA0CE13F96C91DAF21EAE2155B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L......d...........!.........................................................0.......d....@.........................P3.......3...........V..........H...p7......L5......T...................@.......h...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUM98FE.tmp\psuser_64.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):521784
                                                                                                                                                                                                                                            Entropy (8bit):6.352828173572569
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:ZcYznGwe1OMgciIogFK/IMakdTv4aU5i2s1uEn0Tooh/RYD50Zfx86cSAj:HnSgciKFK/IMakZvvClDE0TookV0xr
                                                                                                                                                                                                                                            MD5:4FBD1394EEAA4D5F7BD66AFDC6FA088C
                                                                                                                                                                                                                                            SHA1:8D09DC6A9C06A8B549273BF121E7D3D41E8929CC
                                                                                                                                                                                                                                            SHA-256:7A9F75B840515009ABDA7BCA9372C97C5514E32D0324A2D01A7FE377A3889762
                                                                                                                                                                                                                                            SHA-512:089160F6D4AEE7A1C6C550F256BF52573A71E8CDCBFF19AA829618DC1D29B772288CA76A270001DA09B19BFA175DC20829607F9C3035C672D2289550927371F7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d......d.........." ................(........................................0............`.........................................`....................V...`...9..H....;......(......T.......................(...P...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata..Z....0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............J..............@..@.rsrc....V.......X...L..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\GUT98FF.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            File Type:POSIX tar archive
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11550720
                                                                                                                                                                                                                                            Entropy (8bit):6.033044964444277
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:+aEmBopka2Rn0ttjsQlms7+oWD0/v+lzP+5ItO04rq7D0S8zpWwRFh4rH5EaFh4l:SpF2Rn0ttjt7+1I0RQcmiGYTGLB
                                                                                                                                                                                                                                            MD5:0E16371DE9A96CAA60FFE3CCAFBC8343
                                                                                                                                                                                                                                            SHA1:DFF8071D944CDE352DE9F34CCFE785F7DE1C3C0B
                                                                                                                                                                                                                                            SHA-256:9DAB943357DBFEBD3F2AC522D9C4565E90EB8428A01248F7F1D68BFB75B5A416
                                                                                                                                                                                                                                            SHA-512:28D6C511392E06CD0A4EB19573DF78A0E12215253D36ED10BB84AD70203A9204C1638AA836BD57AAD036D2BA6D31AB5F827AC60F81A1F4C26B89C56B25FC49CB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Yara Hits:
                                                                                                                                                                                                                                            • Rule: PlugXStrings, Description: PlugX Identifying Strings, Source: C:\Program Files (x86)\GUT98FF.tmp, Author: Seth Hardy
                                                                                                                                                                                                                                            Preview:././@PaxHeader......................................................................................0000000.0000000.0000000.00000000034.00000000000.011452. x....................................................................................................ustar.00................................................................0000000.0000000........................................................................................................................................................................28 mtime=1686220543.2942097.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):383232
                                                                                                                                                                                                                                            Entropy (8bit):4.3682050352007735
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:iPfhJk6XlsbrElrmPARuDnQe09E32yIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AD:cfYKsHKmz+K32OTixcvcDwn
                                                                                                                                                                                                                                            MD5:1694092D5DE0E0DAEF4C5EA13EA84CAB
                                                                                                                                                                                                                                            SHA1:894F3E31CC3666728F2D7A8DB6840D4726843DE5
                                                                                                                                                                                                                                            SHA-256:A178FFAD4526B68BA0106032D612164004F20F08B8EF7FDF986429A1CF7708A0
                                                                                                                                                                                                                                            SHA-512:882A9392507BF0E089952F17E2F40DB0C5E1C52C6A6F5C7CDAD61DEDAF1AF734F23C317C0DA77A980D6ACC38E169302E1B024AD393BB730851786146BC38E17E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2R..aR..aR..a...`X..a...`...a...`F..a...`t..a...`C..a...`@..a...`Q..aR..a...a...`S..a..%aS..a...`S..aRichR..a........................PE..L......d............................T.............@.................................t\....@.................................d'..(....P..(f..........H....6..........L...T...............................@............................................text............................... ..`.rdata..<].......^..................@..@.data........0....... ..............@....rsrc...(f...P...h...*..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserCrashHandler64.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):404480
                                                                                                                                                                                                                                            Entropy (8bit):4.403596063022666
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Pzfvhld4VAmlAfFUtxsIKGNGdyIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBAA9:bvhP4VHlAfFUYdOTixcvcK
                                                                                                                                                                                                                                            MD5:09621280025727AB4CB39BD6F6B2C69E
                                                                                                                                                                                                                                            SHA1:A6F3796A310B064D1F2A06FAA9B14C4A104506DA
                                                                                                                                                                                                                                            SHA-256:77B695E9292A10A98C3FC1D25AE05C44FB18A54D74A473D4497B840C8BA94DEA
                                                                                                                                                                                                                                            SHA-512:CBA5DAB19BDEAFC4ECA223A4858B566E3AF21FD690F4F6971864C519D284AAF5A3DF70B98AEB5FABC66A68E515505B203B0BF1C61ECB92070E8E30A92BDA6FAC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g0...^...^...^.;v]...^.;v[.U.^.;vZ...^.s[...^.sZ...^.s]...^.;v_...^..._..^.sW...^.s....^.s\...^.Rich..^.........PE..d...=..d.........."..........6.................@.............................@.......z....`..................................................l..(.......0f..........H....7...0..T...pW..T............................W..8...............@............................text............................... ..`.rdata..............................@..@.data................f..............@....pdata...............r..............@..@_RDATA..............................@..@.rsrc...0f.......h..................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdate.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):440608
                                                                                                                                                                                                                                            Entropy (8bit):4.477495049012643
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:TjbidjsOQe3H/lqa8ggDemWSzuwJWwqjPpiIFWNjdkjAGAOK0Lxmb9rvp3AzAwBv:ytqa8VxJMReTixcvcF4fZNVw
                                                                                                                                                                                                                                            MD5:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            SHA1:B267CCB3BBE06A0143C1162F462839645780D22E
                                                                                                                                                                                                                                            SHA-256:66E75EA8A3641E419D5226E062F8F17624AFBEE3D7EFD1D6517890511E7111D9
                                                                                                                                                                                                                                            SHA-512:512F2C2BE5EE5F61F31719344CD20DD731898C5B63F6E1ABDBFC81821533D93AE06C96F256AC1196E9F457A927C4AA61C35D00B45181793547FF3B6670866CCA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.<r..R!..R!..R!..Q ..R!..W ..R!..V ..R!B.V ..R!B.Q ..R!B.W <.R!..S ..R!..S!s.R!H.[ ..R!H.!..R!...!*.R!H.P ..R!Rich..R!........PE..L...b..d.................<...L......;z.......P....@......................................@.................................`q..x...................H....8...........^..T...................@_......X^..@............p..\............................text....:.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc................T..............@..@.reloc...............n..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateBroker.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):384296
                                                                                                                                                                                                                                            Entropy (8bit):4.381583745540333
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Vvs32BUKqsL6FBqrk0z3M+82nOiIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBAn:Bs3Uq+2qXnOeTixcvcGLNI
                                                                                                                                                                                                                                            MD5:A86AD7C0E95907CBA12C65A752C02821
                                                                                                                                                                                                                                            SHA1:26EE2DF5A6A47FE976AF1592B20BCBEBDAFFC4DB
                                                                                                                                                                                                                                            SHA-256:4E596090A150EB2B7478A42B7A2287EB8E0C80ACF2776AA7A55DFE9CC5013718
                                                                                                                                                                                                                                            SHA-512:62D869B8FEC28D10EC6A1B78B6F92555B0DBA2E92BAC203C569CACCB30B1BB33128346C158A04262271D43D09AB0ED207B99A19354215D5A8907FCA01B654C60
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L....d..........................................@.................................R:....@.................................$8..<....`...f..........H....6...........-..T...........................`-..@............................................text...s........................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc....f...`...f...0..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):438592
                                                                                                                                                                                                                                            Entropy (8bit):6.45992761938075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:/iooQx+F24u9wHXNiOc20bNcooY50EkY:/mQUkyiOc20ZcW0Er
                                                                                                                                                                                                                                            MD5:35BDDD897E9CF97CF4074A930F78E496
                                                                                                                                                                                                                                            SHA1:69D5E69DDF4132FA2A5AE8B8B36CE047E560A476
                                                                                                                                                                                                                                            SHA-256:B2DAA382D892FEDB01EE0FC960671A96C1D21C663F1883D800F70D72FDD13F91
                                                                                                                                                                                                                                            SHA-512:A484F13F5427B20623BC0451BD223C0D89EDA0B0789749B46F2981CD7818A0D795B2868840E5BB9A0C6C8020939D085814A6BBBAAE4425B2F0C398C913F246DF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5..PTg.PTg.PTg.$d.[Tg.$b..Tg..!c.BTg..!d.ZTg..!b..Tg..!n.kTg.$c.ETg.$f.MTg.PTf..Ug..!b.QTg..!..QTg..!e.QTg.RichPTg.................PE..d......d.........."............................@....................................R.....`..................................................................p..t4..Hx...8......d.......T.......................(... ...8............................................text.............................. ..`.rdata...|.......|..................@..@.data...08...0......................@....pdata..t4...p...6..................@..@_RDATA...............d..............@..@.rsrc................f..............@..@.reloc..d............j..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateCore.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):755696
                                                                                                                                                                                                                                            Entropy (8bit):5.78064070271127
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:W7HWEcC7f+bctMN8hnPTscowfOTieHsgX+:W7HWvbcNPTJowfOu2u
                                                                                                                                                                                                                                            MD5:5174340282DD8A0FF39480395F5BC5D8
                                                                                                                                                                                                                                            SHA1:08100AB4E019A149CC484BDA66CCC5C28DC2D2ED
                                                                                                                                                                                                                                            SHA-256:C78E5106DEBB7D891A9B3DF684EDE2DA295B8E7B595F899CEB8400786A627EC6
                                                                                                                                                                                                                                            SHA-512:8B2A3DB0DEE98435F2C5ACF8DE8617FE72ADD9155F3AF491CDFBE6770346DD31CAD387D3E2877E3E5332117A30D08DA428CBF9C7E3C72C6E6E486F4626BFD1AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.P.4.P.4.P.D.Q.4.P.D.Q84.P.hjP.4.P.A.Q.4.P.A.Q.4.P.A.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.4.P.6.P.A.Q.5.P.AhP.4.P.A.Q.4.PRich.4.P........PE..L....d............................0t............@.......................................@..............................................f..........HD...C...`...A..Xw..T....................x.......w..@...............8............................text...*........................... ..`.rdata..............................@..@.data...DG..........................@....rsrc....f.......f..................@..@.reloc...A...`...B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateHelper.msi

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Norton Update Helper, Author: Norton LifeLock, Keywords: Installer, Comments: (c) 2022 Norton LifeLock, Template: Intel;1033, Revision Number: {F1F27AB3-30CC-48BD-90B4-7AA3CF80EB1F}, Create Time/Date: Thu Jun 8 11:50:54 2023, Last Saved Time/Date: Thu Jun 8 11:50:54 2023, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):3.710330368678027
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gPeAETBOSI7Ley3M5ICNsSSAoHx5Pey3M5IC0ioXh:SMBOS8eWMmCNsjeWMmCE
                                                                                                                                                                                                                                            MD5:079852B401B4C83A1982255DCFD795B3
                                                                                                                                                                                                                                            SHA1:4C54232099461DECAD52F45F827503B7C40C8BD0
                                                                                                                                                                                                                                            SHA-256:1F0CBF6DE9A292E02474D32763D54F22108FB15226BD4D2D5B8113C3207A1248
                                                                                                                                                                                                                                            SHA-512:1F07204FCD763FBFDA6D535F9CF4C9971045CBFF3127A2464E46529A8E59FF5269490ED5AB74F71FD957F0ABF3B42D2CF8258F12738D543097EC0DF89E8FFB2C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateOnDemand.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):384808
                                                                                                                                                                                                                                            Entropy (8bit):4.377706577325397
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:zvMP2ZEKysLSFBqr80w3M+D2nKiIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBAW:bMPMy+eqLnKeTixcvcjLNm
                                                                                                                                                                                                                                            MD5:C9824519E8613D8B4CAD44060069C19C
                                                                                                                                                                                                                                            SHA1:8D253977D0236494471FBFDAA6AB3EEF1315AC15
                                                                                                                                                                                                                                            SHA-256:11F3E42F19333E5917E7DB62FA8E7F966EB9624E86711E413AA43284B8D03244
                                                                                                                                                                                                                                            SHA-512:0F2E11E11C1C8D477EA8C2C6C70D24484AE913CC1FC785E945141BD035745914CA307D67BDEC3A45D443BEBEDDB536A910E4E1F2A285AA807217576262AE4D21
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L......d..........................................@.......................................@.................................,8..<....`...f..........H....6...........-..T...........................`-..@............................................text...s........................... ..`.rdata..j^.......`..................@..@.data........@.......&..............@....rsrc....f...`...h...0..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateSetup.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1910576
                                                                                                                                                                                                                                            Entropy (8bit):7.58137479903026
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:hbGcPcWSOwiGJ+aKznZOqbU3tFKU+9wOKXd9AVjrr:xGGcWSYGJ+94iU3tIU+qOs
                                                                                                                                                                                                                                            MD5:2B07E26D3C33CD96FA825695823BBFA7
                                                                                                                                                                                                                                            SHA1:EBD3E4A1A58B03BFD217296D170C969098EB2736
                                                                                                                                                                                                                                            SHA-256:2A97CB822D69290DF39EBAA2F195512871150F0F8AFF7783FEA0B1E578BBB0BA
                                                                                                                                                                                                                                            SHA-512:1B204322ACA2A66AEDF4BE9B2000A9C1EB063806E3648DBAB3AF8E42C93CA0C35E37A627802CD14272273F3F2E9BC55847DFA49FC6E8FFB58F39683E2446E942
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].T...:...:...:...9...:...?...:...>...:.K.>...:.K.9...:.K.?.).:.A.3...:...;...:...;.n.:.A....:......:.A.8...:.Rich..:.................PE..L...]..d.................n...J.......R............@.................................u.....@.....................................x.... ..|...........H....j..............T...........................@...@............................................text....m.......n.................. ..`.rdata..Fr.......t...r..............@..@.data...............................@....rsrc...|.... ......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateWebPlugin.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                            Size (bytes):384808
                                                                                                                                                                                                                                            Entropy (8bit):4.377540113876844
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:A3sX2IVBI6XgpbbreB3Hu9+323+iIFWNjdkjAGAOK0Lxmb9rvp3AzAwBf801AJBU:qsXTIgmbl3+eTixcvcXbM/H
                                                                                                                                                                                                                                            MD5:1B7BD9F313FC670D5DFC1EDFEEF50D0E
                                                                                                                                                                                                                                            SHA1:F95F0DB0E6392022D314EFD14F9B4D542D2DF3C2
                                                                                                                                                                                                                                            SHA-256:968A9AE84C45CF635CAB1F50843CD970FAE0BDF3F7837FE26D7D64C8E3C0A837
                                                                                                                                                                                                                                            SHA-512:232FFA2890FC3504EE8D2DECB80603B5873C8AC9E8F92D09E3E4BE7AFAE7DD88121CD176F5C487BB59809B577705F226B7C63D8743CBE4FCEABFECD429D765FD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L......d..........................................@.................................5.....@.................................,8..<....`...f..........H....6...........-..T...........................`-..@............................................text............................... ..`.rdata..j^.......`..................@..@.data........@.......&..............@....rsrc....f...`...h...0..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\acuapi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):561456
                                                                                                                                                                                                                                            Entropy (8bit):6.89287156869539
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:Yfpc+D07/a7PLl5FibVV1e80fe7KM7DhphezIhSMXlLSGvYOO:ID0KcVV1e8IkKM7DjhezIhSMXl+onO
                                                                                                                                                                                                                                            MD5:A400B5A4A3CA4745149ABAA4C58FAB2D
                                                                                                                                                                                                                                            SHA1:D8BC7CF9735E4A6958FEB7079A505BD1C4516F24
                                                                                                                                                                                                                                            SHA-256:89515235500904C8BD34844D4C71F2707750BC5E7C48AFD3409B012EB5A1E544
                                                                                                                                                                                                                                            SHA-512:2762EE517E08FEBA6345521ADF6C516352B672882DB2A6D3220F2A62A60EFB6CB2DD2AB04BDC20A60092A5922A4B7C83484C8FD3FAAC3BA817A4BDE84D23592A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................E.....................................u...........................Rich...........PE..L...[..d...........!.........p............................................................@.............................l.......(....@..p...........HT...<...P...8......T...................@.......h...@............................................text...d........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...p....@......................@..@.reloc...8...P...:..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\acuapi_64.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):719056
                                                                                                                                                                                                                                            Entropy (8bit):6.672324901238704
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:X+vBHtQ7iF5WOFQYOupOwoH6LztpMQV/t9WQF2FiWurraKlIDn1LGNGho44v+aXx:X+5HnQYOAR7WGtZhezIhSMXlgIv
                                                                                                                                                                                                                                            MD5:56464A7270CDE8F1EFE3A4DF0C7FBA88
                                                                                                                                                                                                                                            SHA1:3B857008BDB409DAEF3441C656C0CA09B283F80E
                                                                                                                                                                                                                                            SHA-256:85FBCDB8D8FF254D35664000529BC1FDE00427B624F806E6A2CF839AD7332698
                                                                                                                                                                                                                                            SHA-512:A0E7E8C45129E44D775DBB3DE53D72F17EA17EBDCCA89C0C69B56FB6AD3694227466452387378F915241390769BDF42B5E58D104C8C1839915878DD698F30CDF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.b2w..aw..aw..a!..`r..a...`{..a...`...a...`c..a%..`y..a%..`}..a%..`8..a...`p..aw..a...a/..`u..a/..`v..a/..av..a/..`v..aRichw..a........................PE..d......d.........." ................................................................aB....`..........................................A..p....A..(.......x........A..H....B......$...x...T.......................(......8............................................text...,........................... ..`.rdata..n}.......~..................@..@.data....?...P...&...8..............@....pdata...A.......B...^..............@..@_RDATA..............................@..@.rsrc...x...........................@..@.reloc..$...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdate.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1707520
                                                                                                                                                                                                                                            Entropy (8bit):6.329347716504747
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:Lpkb22RntN0ttjsz1srDlmsmTKmTyuuNV:Lpka2Rn0ttjsQlms7
                                                                                                                                                                                                                                            MD5:5F2D68D3FDAEB09AE78622A5AE59FCE0
                                                                                                                                                                                                                                            SHA1:D959C2A9E03C0C4017682C5F48EB1BBD84DD796E
                                                                                                                                                                                                                                            SHA-256:F2AF299BE74EBBFD19BB476D66BDE4D55BFB571004B6349EB5EF1971955F683F
                                                                                                                                                                                                                                            SHA-512:D0F9BA99DF9153A8487FD0C4A3F81C0138AEABAAED9875A8E175531E2BDF18F7B89AE14CF52BF7F546B3B5076B87080096D5C15558B9BD16A44585C0C0171C54
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........n%.B.KMB.KMB.KM..LLC.KM..ML@.KM..HLP.KM..NL..KMsS.M@.KM.zOLS.KM.zHLZ.KM.zNL..KM..OLc.KM..JLi.KMB.JM/.KM.zBLr.KM.zKLC.KM.z.MC.KMB..My.KM.zILC.KMRichB.KM........PE..L...b..d...........!................oG...............................................E....@.........................`...T............@..(...........H....c...0..........T...................@.......h...@............................................text............................... ..`.rdata..j...........................@..@.data....\....... ..................@....rsrc...(....@......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_am.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.850152460164065
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FR/vRi4k4+R2T35Jy0Wp2xPxh8E9VF0Nyme:FlIZJQy0WsxPxWEc
                                                                                                                                                                                                                                            MD5:72E47A3D3E835B08D1AE65D4F69F77E0
                                                                                                                                                                                                                                            SHA1:7F086000901CF2518C35E1734EA1ED9E10DE369C
                                                                                                                                                                                                                                            SHA-256:FF74207E5107DC2DA38AAA4DE10BC8EA83FAECB2BCA0BF985A7E5A6B427643C0
                                                                                                                                                                                                                                            SHA-512:02124755B52423CF734C6CC28AF44FA7F8DC79EB4E9E475208FB6591AA2317A149B7EFC0E5E7A3DFBAEB9CDEF9ED69084C45DB6221003DE69D6AD1B45B9C09CB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......d...........!.........z............... ............................................@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ar.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42944
                                                                                                                                                                                                                                            Entropy (8bit):4.835542008183028
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FruDM3lkCAu+JGPpHJy0W5m2Pxh8E9VF0NyhAd8:FUSlkCAd2y0WPPxWE7C
                                                                                                                                                                                                                                            MD5:A37370A759932400EED7EAEDDBB482CE
                                                                                                                                                                                                                                            SHA1:638E51217F7DF449D41067AB3135D5912517B858
                                                                                                                                                                                                                                            SHA-256:F183305C17D1C06C3006816E1BAD733599E977C1207332799399CEBCBDC7DF20
                                                                                                                                                                                                                                            SHA-512:9FAD66444C544519FF4898DEE7772923DD0708A27422D02475715E9F1B10C058CBDD8B4C53E8B0E25F7B0CC4B967DD33AD4A36BF21A4099699F87B69FEC4DD97
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...1..d...........!.........v............... ......................................{6....@.............................D....0..(....@..Pm..........H|..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pm...@...n..................@..@.reloc.. ............z..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_bg.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.8691314938087595
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FsBzeydckieGZBOcuUFjJy0WgXTPxh8E9VF0Ny6gIBb:FmLVEDNfy0WQPxWEkDR
                                                                                                                                                                                                                                            MD5:01F941A4B83FABF16E5BC21100B69D38
                                                                                                                                                                                                                                            SHA1:AB6E4B97F90CF44CE6463E96FC97BAFBFDD750AC
                                                                                                                                                                                                                                            SHA-256:79E3DA0E23396DABF17FDC7850D84BE5BFC7D6C7E27D6A83EC2DD3537CDE8912
                                                                                                                                                                                                                                            SHA-512:DAAD8ABF022623447EFB08B1B931F52F2328587FE3FED0D510D036E72CC0F293C8584D10F63EF3268768E93C75018CDF4D4128BF863D517B432EB758570C8EA1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_bn.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.936222804071481
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F0aapGvUx7tYF7qWF0FrHF6rjbmBwRbooJy0WNRuyZPxh8E9VF0NykWri:FWsrBF0FrFnBwZy0WT/ZPxWE6
                                                                                                                                                                                                                                            MD5:663E632846D59788FCEB10677488AEBC
                                                                                                                                                                                                                                            SHA1:D55E88C98121FCEFF9D290E48982B7B4F2204BAA
                                                                                                                                                                                                                                            SHA-256:1DFC05748521BCCA9C4BB71E2F02E2FA52B657D0F8DB1747BC9B4B27997A60D6
                                                                                                                                                                                                                                            SHA-512:13F29325EA1C5055B4F344B7B43B52E754D3C1645263F0168F8936D26B98EB5E352E1F1DAFD68E99DC88A6B976A23BD0BA2DC1A73AC27186B8B5F742A18C8C09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...w..d...........!......................... .......................................@....@.............................D....0..(....@...y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ca.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.655403186782661
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FTYiIP42ArzVuJG4bPl7aJy0W3kPxh8E9VF0NyVhQ6:F6Q2ArBuhoy0W0PxWED
                                                                                                                                                                                                                                            MD5:EC63069EFD260AD24F218AE84882F3FF
                                                                                                                                                                                                                                            SHA1:5875DEFDF669CC4747C4F68536E9117DE2BD4A53
                                                                                                                                                                                                                                            SHA-256:BC60127E50FA8E89422966554F1E9319A0E0DD750525812463E0560E48D92FBD
                                                                                                                                                                                                                                            SHA-512:13D4FE8F6227C54EF928CAE48F8B2854218DA04174B60D70BCEE410C248AD2CFA974402093A795AE275C5F4CDCECDD9426B50FCDBC3F0F64B6F0B0D9BB06EA2F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......d...........!......................... ............................................@.............................D....0..(....@..(y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_cs.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.69656607023198
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FAthlsBWpKJkbYAA+fjoDJy0Wim+FPxh8E9VF0Nyy6:Fwb+y0Wt+PxWEs
                                                                                                                                                                                                                                            MD5:0FCE99454CFCC351D251FA0E9EA77840
                                                                                                                                                                                                                                            SHA1:7B9575192E105B4CB724F51238A2E5E956A76425
                                                                                                                                                                                                                                            SHA-256:8DD39E95CD3515398AED12677DB59D71C0773588FF927A6A782A3BEFCF5B1F5D
                                                                                                                                                                                                                                            SHA-512:61AA083B1C5E2EE9DE23C9BB14B25DEB71A3E6F962495542F83F8D068D5046722D287A7EF5247217FA5EA712572B0EEEADC1B2B3263CB70C061648FED030CEC2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......d...........!.........~............... .......................................5....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_da.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.656501839350111
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FIq7uqfNnwtpY6PSKpJy0W/s0UEjPxh8E9VF0NykMR3nD:FLHnwkOdy0W0lEjPxWEqq3D
                                                                                                                                                                                                                                            MD5:D6F44DC235F838BF4E52165182FC0969
                                                                                                                                                                                                                                            SHA1:1EAAD935A6FF147ACBB041397B9E9D63B0EE1270
                                                                                                                                                                                                                                            SHA-256:8883FD2E7810EB9C4DA66888BC548074FE990AE652CE59A053CBD25E39AE08DB
                                                                                                                                                                                                                                            SHA-512:20792C1D1E1C174EB86F72BA92F83A92C025DEBF68DB2BA9E3C9346FE4ECCEAFE0F94BE62706CB8D16F8A6529A9358A4FC8A189B22178E501B654A1D4F6952A8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...a..d...........!.........~............... .......................................D....@.............................D....0..(....@..Hu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_de.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47080
                                                                                                                                                                                                                                            Entropy (8bit):4.647516797051505
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FjmAR6HUj8gtdF0Me39ADEZoJy0WwymPxh8E9VF0NyaBB:F6ojeMe39APy0WwPxWEc
                                                                                                                                                                                                                                            MD5:42B89B0A42B907D63FE680AEDD8B32C7
                                                                                                                                                                                                                                            SHA1:2B36C8BD041331D835DD897AD5FFD29E41ABC52C
                                                                                                                                                                                                                                            SHA-256:E1B6FA1ADC79ADD6CE803DFAF4CE5D5E4DB70EED08223C4EAA381CF0EF55C62A
                                                                                                                                                                                                                                            SHA-512:539D3B51BF450BFB80FD90D52E8A8C2BE077ED39F3E3657FA21DE4B65E391144AFB80CE6C57AEF340EC67821EBA3A886B2E072F7D64152119187ED374B5A73C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................_.....@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_el.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.945276126044921
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fkwaa8EpeILkSIrGCSqlIxRFiAhAu8zBdfsBsTbV234sJy0WRiDEPxh8E9VF0Nyg:FgCplLO+R5U/+y0WoDEPxWE1
                                                                                                                                                                                                                                            MD5:CB574CC86D8FD65185E9C93547D9B98C
                                                                                                                                                                                                                                            SHA1:1271590C4BDED66D5179B1820E9F66C243DEBCDE
                                                                                                                                                                                                                                            SHA-256:7AD4C02B86EFEAC6E068CB0A47D50FD305C2306D71D1BB9812BE9F712597FBDF
                                                                                                                                                                                                                                            SHA-512:E170E7A987646CFC71D9A18FF7119DAEA7AD9C57040C4BD131F86499F663328E9A82240F130699AC10F9D2DDC04154C6D2661A32D768E98B40A0472698E31C3F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... .......................................X....@.............................D....0..(....@...{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_en-GB.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.636317941438334
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FR/vElagyh6QuXCA702Jy0WEwRPxh8E9VF0Ny9+W+Eh:F9gagyhiX9y0WFRPxWEjaE
                                                                                                                                                                                                                                            MD5:D73F4E5F97B987B8CC6403909C3E6242
                                                                                                                                                                                                                                            SHA1:0A7075A927333557161BCDE22D08C35FF7636425
                                                                                                                                                                                                                                            SHA-256:30CD762237C21B6FBA4E0B165EBAB83A997C093BB088A3DF56CEE400F5946439
                                                                                                                                                                                                                                            SHA-512:F7B561BCA0F7DBA8BEB19EA4E2B041766FCEBB940776ABD4C79E561ED0997E6D8E3F27927E5DAB6F03CD45ECEFB568BD872DC67F456BF19881546B51DE955B13
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ......................................L.....@.............................G....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_en.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.6565699525229025
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FbRnyUEagyWmpRjy+Jy0WXyDPxh8E9VF0NyYIm9:FbE5agyWqby0WGPxWEm
                                                                                                                                                                                                                                            MD5:2059F62477F33F9943DCE5DB380F09A1
                                                                                                                                                                                                                                            SHA1:62300C5FA2465D535D77B9D378BE7039CE32A234
                                                                                                                                                                                                                                            SHA-256:CA0F11FE6BCD7CBD9897F73A0B5208C49779B298A2DF260CE084912AE73E5C66
                                                                                                                                                                                                                                            SHA-512:AEC61BB34B79A6666E8EAF56372D049F184F02894B8425FAADAB9C4A2E812BFECF250FE561CB92FED2F3B965735BC2E7E97904C2667241A840611C0F4E0C768F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...L.d...........!.........z............... ............................................@.............................D....0..(....@...q..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_es-419.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.646030612051221
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FI4fk8AqfN4imEDMaJy0WG6sPxh8E9VF0Ny2C4:Fdk8TfN40xy0WiPxWEIv
                                                                                                                                                                                                                                            MD5:E4A1B678F8B6FAB9034EC4657F1D264C
                                                                                                                                                                                                                                            SHA1:4ACCEDA598F41B7FED6EC58E65121D0A37256638
                                                                                                                                                                                                                                            SHA-256:FAF3E79C113E5423DC0C2308FEEA2B1F1D8A5AFA1BB2D9AFCF4684DAF4B6CA95
                                                                                                                                                                                                                                            SHA-512:2F0E1015224B255535ECBC3691E4F96A6885DC59CDDFBADCA160DA9A45C6BEF2C24AFB6FB3057FE7144E739AAB54F6BAB936A9EA59450411B8E02B318E495B3F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...5.d...........!......................... .......................................2....@.............................H....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_es.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47080
                                                                                                                                                                                                                                            Entropy (8bit):4.630177626115215
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FwNCID1Nz518DNQJy0WEnKPxh8E9VF0NyON:FbIxNN1SAy0WlPxWEo
                                                                                                                                                                                                                                            MD5:5F9A8F94E5B85C41CD81F88119D04F30
                                                                                                                                                                                                                                            SHA1:D5DAC5F57002A1B43B0A83EADC9D2627492505B8
                                                                                                                                                                                                                                            SHA-256:AC2418963CA15734DE3135131C1BDA03D7E602034DFCA75F8D11BCA47B577AB9
                                                                                                                                                                                                                                            SHA-512:A9BA94B650BFE076584D1F465B293F49C9DDFEF747EF51B728FB4988391874542F8029BF4699B304132C8B96A29F29935A213102F3A8EBD3086C54BE6ED86388
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ...........................................@.............................D....0..(....@..p|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...p|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_et.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.645463686029905
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F3EEy0TbDFbDZETJXTSQ8QjGJy0WizPxh8E9VF0NySS:F9j96dHYy0WWPxWEE
                                                                                                                                                                                                                                            MD5:9BC3B29E68A70E0DA276D2F80D5609DF
                                                                                                                                                                                                                                            SHA1:DA3DA32BCA70E64D461B2B7F25C0FB1B0B4B5A0D
                                                                                                                                                                                                                                            SHA-256:19BA49FA519608B6955018FB8B77E39D1356EB1817A8993622F8565322C14CFA
                                                                                                                                                                                                                                            SHA-512:2781E997A4F3C92DE141F14250098779307513F4E7C4D493F40341B6A4FDF09671E6FC64781D2AF38B5F19FB8CDF9C2EC03A5724B291F8D279FFF952AD3DD3D2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ......................................:.....@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fa.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.845272670813686
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FqrH4OZNIY5pihSQJy0W3ZPxh8E9VF0NyFxn:FO7cy0WJPxWEj
                                                                                                                                                                                                                                            MD5:5089CC134B762C266A2D935DA3C8334A
                                                                                                                                                                                                                                            SHA1:E4D142E7B12A64B396E83698467900209B2345FE
                                                                                                                                                                                                                                            SHA-256:1D68B46775921FDE73E30BD0DEA980CEE5D7ACB191DF2D91E16E934400609B20
                                                                                                                                                                                                                                            SHA-512:3A551EFDCC0C0D221EB8BF883EA5312C77FCAEFED6D1EB412351B63945DE9F905F2968C21DBEAD7634E180742DF668F8D1A5A2DBF1EE2C4102AC51291B7B1C3C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z.d...........!.........z............... .......................................r....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.6596573287160785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FCcrgPnEzPhXY7R799hKh1GAm/RnVJy0WhhHPxh8E9VF0Ny9rrlR:FLinEVmNgiy0WDPxWEvf
                                                                                                                                                                                                                                            MD5:5BAB01B758FCB17579A8AAA3ED7A6787
                                                                                                                                                                                                                                            SHA1:53800C375AA17BB906ECA53548FA70191AF221E8
                                                                                                                                                                                                                                            SHA-256:874E4BD71B4604929D88E50D673D52A1A1BC6AFA78C244DD642BA20F302F3E44
                                                                                                                                                                                                                                            SHA-512:05C5936FE09642E71FF8A8ADE4F4F2283B67E8EA79B58C856008DE14CB7BA1163EDFE54B16E517CFF1354693792627B1CAF45D8F0BE5A3D563B9592A4711D4BF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ......................................3.....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fil.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.640479522161056
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FUJKU7UNPli+B3RVaw7ykIIjyC/zaJy0WLnaPxh8E9VF0Ny4S:F72U9li+B3RVawW3WrSy0WbaPxWEG
                                                                                                                                                                                                                                            MD5:17F5249CFB6519985F90655B8D802117
                                                                                                                                                                                                                                            SHA1:2A09E55A2FD07214DAF47A331B6CDDFEA543141A
                                                                                                                                                                                                                                            SHA-256:2362F65816A9D66D94E1B3B4BCE49D2E967B5C92C9326321107A84AB811ACA1A
                                                                                                                                                                                                                                            SHA-512:0EE92E8D81A4E6988F1D2315D5E2AA78629EE142E38D6F104F5115FD983CC3E98142E88859DBCA879315A6843A8AE65B26C507AC4EF25D3B11293551C0B90DAD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................k.....@.............................E....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_fr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.662517782893104
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FM1NdxA98EoIcpW4xq9aJy0WbiA4Pxh8E9VF0Nyko9hl:FadOaIcNjy0W2tPxWECah
                                                                                                                                                                                                                                            MD5:FA87C9DCCA6C104EF4B31FA398150A98
                                                                                                                                                                                                                                            SHA1:22A7F252994BD2C99ACA4F1C544BA1E88A249F4F
                                                                                                                                                                                                                                            SHA-256:0B5678F58A8F8C8619D0940D981B40971F8B42028EDBB2FA845731C747D3B567
                                                                                                                                                                                                                                            SHA-512:FD918AC8E95A7CB33CFCC141ED25F1D5848497BF3645F912FCDBEA64A1BAD1ABB440248E2F56E1C7D7BA8AFE4D3B44D83FEB8C759970203F5CBA147737F4C3B1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...b.d...........!......................... ......................................<.....@.............................D....0..(....@...{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_gu.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.923122510985089
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F0Uc/d3UTeAV4DzYCQ+fwmkIjkiJy0WpJ84nPxh8E9VF0NyZEdgnV:Fm1UTe7VbRy0WpPxWE/V
                                                                                                                                                                                                                                            MD5:E9C9B0BAA58684779947F9DDAC85E83A
                                                                                                                                                                                                                                            SHA1:FE70F8278CF6594D111BB53E0059F1C023AEDCC0
                                                                                                                                                                                                                                            SHA-256:19154A82982A69B588B8A89AC086E80E515B05704899E1B8CA7AF3DE460568F5
                                                                                                                                                                                                                                            SHA-512:41A03F1FA4242E5297F3D4FD18911B64AB1D31E529C964A7A5327E3B8C1389BD1F9CE4EA5A444D64B36808D908BF663235DA81BECA3145049257E258E483FBA8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................B.....@.............................D....0..(....@..8z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.8817065986468595
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Fc6qx6AN6Aaqxzxm8qRXtpqCGay0WKLPxWEE:Fc6qMX31LPx
                                                                                                                                                                                                                                            MD5:282452593ED4C14AA8AD486698BCBB31
                                                                                                                                                                                                                                            SHA1:8CF912912503649E440E632CEA6B4427A0B1102E
                                                                                                                                                                                                                                            SHA-256:CA151F677D1D9ABC95C708726B3D04C62AC7C7836ED9B875C5B1F7D67BC4F75A
                                                                                                                                                                                                                                            SHA-512:9FC0A8FC7641A104B3976F37421DCBA2083878DA535B3662A6FC1F697CEF5108D1715BA618806CAD4E74B13F2E2AAEA10090937F1BD13CDCBB9D8EF7141CFFE2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.6636431303483
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FZitIPeVOXz19zzMH5KBL/yoiGgJy0WXfjjPxh8E9VF0Ny6/R:F8I+5oL/xwy0WLjPxWEs
                                                                                                                                                                                                                                            MD5:85D54C0B73692E53C5B8657ACD189EF5
                                                                                                                                                                                                                                            SHA1:907D142F69B742F7DE5F8738325C7CAE9CA06ECD
                                                                                                                                                                                                                                            SHA-256:4BAD5B8F0372FC19E9414F997B2CF713D81F48FEC6238CDBEFA65CF138E9F5A9
                                                                                                                                                                                                                                            SHA-512:3B1B2792237EF8F6143644FF54D25E7BC95ABF1C89291B0B1BB16DE4C8CC00B7DCE18510306BC94C19CA2BEB33472CCF4DB2976D508E817F06A695F4FB4F6345
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...K.d...........!......................... ......................................F.....@.............................D....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_hu.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.688666100525905
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:FfG7U7RPX1C2TycfBwGFTbeSTZ46931lBVZpjqAy3FGVsTsy0WMNPxWET:FfG7U791C2TzpwGFTbNZ46d1lBVZ5qAV
                                                                                                                                                                                                                                            MD5:EC0EAC7B38E7B4FB9F4F3E97CED70502
                                                                                                                                                                                                                                            SHA1:8A21DEADB00C4A23ED0EF2728C5EBE6D58D8E93C
                                                                                                                                                                                                                                            SHA-256:D083015F17E68E2304A2F4C9A130BF2891A1B3545DCF35E3E6367276BC8FF1C9
                                                                                                                                                                                                                                            SHA-512:43E7EC301C8E4E7259B6038EC5F17C52C27B64CAC69511B6325B50B949F56A782312D28D7264BF4469D3A48FCB73DE831DE0FB388735E1928774742B0D0E8383
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_id.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.639484979051941
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FpZ0+vL3THRxVkAHqIaHQRf2I95yrUdGqPfpJy0W5C0NnPxh8E9VF0Nyoum:FEWfqgbfzy0WnnPxWE+L
                                                                                                                                                                                                                                            MD5:351FAB792600FABBB172E0EB3308A6CD
                                                                                                                                                                                                                                            SHA1:A9BD979F85AC2EE04B63A6F0A266EFA64318207A
                                                                                                                                                                                                                                            SHA-256:FCF17CCCBD9988C121B3754DE7234B3041B7FE83C763A364AFD043297C780745
                                                                                                                                                                                                                                            SHA-512:1C3F626FEF266DA6E8FA5737ECA5CF089150C7CCE2B990ED9F75B2757B509CCB0D15DD38B8CCFB05403C35DDD24745A2105D098B4855E951F987EAD934FC2552
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ............................................@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_is.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.658477005342536
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FOKL63eZkioif2lIPaAjYkUVQFoMUefV3PONJy0WBDPxh8E9VF0Ny6xL3:FouyibAIibkUVQF5UefV3iy0WFPxWEU
                                                                                                                                                                                                                                            MD5:85BCF7664BAE9ECB72C8480214FAE669
                                                                                                                                                                                                                                            SHA1:172FFCD25B4956AB674C008BA1BC6796FDBA11DF
                                                                                                                                                                                                                                            SHA-256:45F41E8D25867AB8C2EF78B866FBED4A201CD451713AEFED27A1E6C4E550FE88
                                                                                                                                                                                                                                            SHA-512:5A92ED998134963A7B76B44A5C6CA8F248BDBB13AFADDC72A5AD1915EC22C98415387295AE2E08209E1BFD866EF878BBBCCF9759C4442DB98340DFB6345B77E9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...4.d...........!.........~............... ......................................%L....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_it.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.6324666300251005
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FLEXOjrIN+sah3MO/Jy0Wt9zIjoCPxh8E9VF0NyTKF8b:Fq2IN+P3Jy0WzI/PxWENw+
                                                                                                                                                                                                                                            MD5:B85708D2C23D44CAC26488C1ADCD676E
                                                                                                                                                                                                                                            SHA1:195D94B76B8D31976ED804DC79ECEE120BCCF6D3
                                                                                                                                                                                                                                            SHA-256:DF621055A085663B147DBFD1F54961A7F4299E7714A69541CAC6E2A8DB17CDA4
                                                                                                                                                                                                                                            SHA-512:83CBACA8F28F4855685365477B008993F00477C006B931B6413BA4FCDE89010B8BDFD0F4DBEEBF864802931BC95CFBDE7DF3D17CAB40D45661AF0B15143D78AC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ...........................................@.............................D....0..(....@..Pz..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pz...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_iw.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42432
                                                                                                                                                                                                                                            Entropy (8bit):4.854173056599383
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FB3XBjD2r9v7hdVexaDyQa/f8sS+9GmJy0WJd1w4DPxh8E9VF0NyYok7o:FCFNMrSQy0WTZPxWEym
                                                                                                                                                                                                                                            MD5:05AAEE6122E3534C4ABF3B3D95E6EAAA
                                                                                                                                                                                                                                            SHA1:D17CEECA35099A36BD99CC017A603B4F486D9FE0
                                                                                                                                                                                                                                            SHA-256:C7292A8852AF042741E768702611672C3CB51E6291A3856249FF240CF5D238A4
                                                                                                                                                                                                                                            SHA-512:A58EB20DDCE03517804A80C536DDBD7866263A68D362AEBC9F7991B81ADF62069CBD39582A88F06F125DBC666EA5CA07C95CA36763B72FE22C6784A64F9CD8EC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z.d...........!.........t............... ......................................H.....@.............................D....0..(....@..@k..........Hz..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@k...@...l..................@..@.reloc.. ............x..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ja.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):41408
                                                                                                                                                                                                                                            Entropy (8bit):4.883723947959775
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F/RouMWEHjkgWDMNGJy0WUqcPxh8E9VF0Ny1nB:F9HEDkgWiey0WkPxWEXB
                                                                                                                                                                                                                                            MD5:F88EF38633AF35044AD10C3400990BC1
                                                                                                                                                                                                                                            SHA1:B605DA6DB49B5C7648912DBBDC17CD0CC70D7B11
                                                                                                                                                                                                                                            SHA-256:9975AE9DF9F8B81C50DCCD0E95D5AAF279F7991071D09E05DC9F622E5497EEF8
                                                                                                                                                                                                                                            SHA-512:D7BE229D8E65A47CF119AF62FDB6720D6A2C9263AC69B6AFA3FADB1BD79EC273D4B0842C73722B629BED0204558933BB108C1A156478E485A5304B39A9EDDAC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........p............... ......................................F.....@.............................D....0..(....@...f..........Hv..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....f...@...h..................@..@.reloc.. ............t..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_kn.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.954692594620765
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FQdMeRW2As8RBSBRPfetJy0WYhupRPxh8E9VF0NyHZ1GF:FX/swkOXy0W+YPxWElrG
                                                                                                                                                                                                                                            MD5:56A3857ADD97B0AB7C19D551028545C2
                                                                                                                                                                                                                                            SHA1:10F0A5B7A2FBE9221C133529B8A5E0B36B421C4A
                                                                                                                                                                                                                                            SHA-256:30B0A74E6F825986E8794911FCFCDA4131B505BB0B5E93BECB098CC1BBEE8D1F
                                                                                                                                                                                                                                            SHA-512:83C846FA62A0AB70AB07B57927F4F53305949A14E942DB8398E6C90769B47894BC9BCB4E3FB9748173A492C43FF5849E4CAF59FD5242757C0DCF7664EB05E522
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................L.....@.............................D....0..(....@..P{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...P{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ko.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40896
                                                                                                                                                                                                                                            Entropy (8bit):4.911833136088746
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FCJcEWZFDd4IY+N1vZsYoRHgA12MrlxB4xRkkTY1M5tkOe+VjJy0W7VPxh8E9VF4:FUlWXmmAq/jveoy0WxPxWEu
                                                                                                                                                                                                                                            MD5:16454F5496343F3383905BEAD12F3388
                                                                                                                                                                                                                                            SHA1:1F38F482A2957A5E19BCA744C13A8931E4AB73D7
                                                                                                                                                                                                                                            SHA-256:4ADDF9F4A52596B37878C3CDEC55F962632272E6C81E4BE75F52C824CBAA840D
                                                                                                                                                                                                                                            SHA-512:4D77D9102583AB084BD7BEE4345202CCA3F7AD1D9A307BB4486A38ACFDAE4F878908E411E1FC92B3CE08F284E3BD8C6DBF321A8F19592ECA7CBD257C413139C8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...e.d...........!.........n............... ...........................................@.............................D....0..(....@..0d..........Ht..x+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0d...@...f..................@..@.reloc.. ............r..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_lt.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.677692678096642
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FGqI1qXnc9eHz0CwTF1B+jF2Xw1KJy0WFEPxh8E9VF0NyO/dz:FOackHz05TF1YjFmy0WuPxWE4F
                                                                                                                                                                                                                                            MD5:E0DA28606791E47FA9B7D50F3637FA65
                                                                                                                                                                                                                                            SHA1:00DF626C1C14D57DC0AB1EFCCFC3CA0B700F3F26
                                                                                                                                                                                                                                            SHA-256:FB4C1B85935F88E2215CCA897993AFDE01740A36429B1D515905AD42A5F9FA5C
                                                                                                                                                                                                                                            SHA-512:9795261821859668D22D63086EC0A6D034043859229138B7899A862DDD6317754479B5D53ABC24895BF91A4370C4648EA9CBED1858E4F44992C6C498090DB1C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... .......................................A....@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_lv.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.703009692113209
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F4sqvepyAxOeKdeccQJy0WZy8Pxh8E9VF0NyISi:Fw8fey0W08PxWECz
                                                                                                                                                                                                                                            MD5:C8802E1E924F5CA936D967BE9FA5DA69
                                                                                                                                                                                                                                            SHA1:31FC7A8BCE71548AA52D0BBB877416BD3B647D98
                                                                                                                                                                                                                                            SHA-256:92CEC5B3CF76DBA98E62A750EACDEE2BC871364133A4C76CDB1E8AEFCB702BC0
                                                                                                                                                                                                                                            SHA-512:4289AAC7A6B5AC3EC0BC767612965D9F9386C832B6F98D44D245CB45D6239C620E7FFC0EBD47793C9014CBAB9B0BD56A6467191806841DA17059C3FE45E2F217
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ml.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):48136
                                                                                                                                                                                                                                            Entropy (8bit):4.926909967496055
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F/TZz4S1BzFZygd8/JLosSJy0WucSjPxh8E9VF0NynYWq:FrR4ISJLgy0W/SjPxWEFY
                                                                                                                                                                                                                                            MD5:16F9F18C873FB7C00F08917F1AF83EB3
                                                                                                                                                                                                                                            SHA1:0FB99CC388FE54D5AA875F79E65A0A73E99D9323
                                                                                                                                                                                                                                            SHA-256:E6F74C212F2E8EB4163C2DDAE84F488B73DEF9CE886340F4A9AF6864978D859E
                                                                                                                                                                                                                                            SHA-512:799209ABEC146B52F3EB5C4D5AFC3DC6482A3B0CFB21C1F1F876BD87D1014E7079AE694C12A80D4660063D9C3D309E9028B4A90887572BCB848B5ABC21AB7317
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...l.d...........!......................... ......................................[.....@.............................D....0..(....@..8...........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8....@......................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_mr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.898551846960824
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Flbeoedw/7JK7bABYlNpJy0WfWPxh8E9VF0Nyq4D:FAlw/7JK7b9jy0WePxWEU6
                                                                                                                                                                                                                                            MD5:B44F9C9DCB53514D6A496C3506F74DBB
                                                                                                                                                                                                                                            SHA1:1DC610693F782D08E3D6985351C298A61AE40614
                                                                                                                                                                                                                                            SHA-256:430FEF5E3BC821188BFC9A180334495B92CB0E8D8C7FA0CED774031D9A7FC8B6
                                                                                                                                                                                                                                            SHA-512:B7C9E4F838BFEF2B781D3871455D7B850135B8FF97FC1968E49BC2AC0B0B1F33DA759AD34F8E43D858A0971F8C2DDCA51925A5A65061E5B90DC4505405DC5748
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... .......................................8....@.............................D....0..(....@..Hy..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hy...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ms.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.652027629630858
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F546L/TKrQLtUv6oNpaAYjZZ/fbMgTRlRE/5nJy0W8g/Pxh8E9VF0NyNDA/XV5:FVw+f3TFAy0WH/PxWEXDiL
                                                                                                                                                                                                                                            MD5:8E1DC4C71BC03D10ED3BD2293B6C3A21
                                                                                                                                                                                                                                            SHA1:6649BCDF0D137AFFA4CA983135FE5EBE3336A495
                                                                                                                                                                                                                                            SHA-256:0C0B827C7ED352F5FC376B3F2F2064CA7A27828907BE77C66585CC457A769F16
                                                                                                                                                                                                                                            SHA-512:AB785D0FFA1F7FA7754254905752366B9BE7B592248DFCF036B087A2EAD07E112228B4D36B954DAEFF2ADB24A0566A9552168BC3FE7FCC5E4DF0E56A95B8042D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ......................................7"....@.............................D....0..(....@..ps..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...ps...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_nl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46056
                                                                                                                                                                                                                                            Entropy (8bit):4.64263735417891
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FUdjv7nGXd/T32SPxLLJy0WGT1+Pxh8E9VF0NyazyEH70:FwGtKqNy0Ww1+PxWEU
                                                                                                                                                                                                                                            MD5:9DAD72B74700EEE3D33603BFFF9E1F98
                                                                                                                                                                                                                                            SHA1:5C9DE57CFD021549D6B34AE225E44BF0BFD662CB
                                                                                                                                                                                                                                            SHA-256:6BDEF62FBFEB7B054E17F463C24A878F537EFFC82F8E3CF96D977265E44F2659
                                                                                                                                                                                                                                            SHA-512:DDF30DD81788173FB0332B548C40A03B9BBD1B32074C54C36150D7AD64AA7DF5974A8FE6D2155E17E22A505F66DFC54147E7B9F88B644EC0F573ACBCB61992CE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...[.d...........!......................... ............................................@.............................D....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_no.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.660574455025035
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fio75JZSiyCSiyVKwRAYSTv4q6K3Q5PacJy0WlxjPxh8E9VF0NytvuLK:FWhCYWv6K3Qby0WbjPxWEHGLK
                                                                                                                                                                                                                                            MD5:EE0889163C7A670DD81A3E05D52EE458
                                                                                                                                                                                                                                            SHA1:A7A834305FAC8F75B1556234F5C0381623B29984
                                                                                                                                                                                                                                            SHA-256:E1960E7A05427B85D79F60F8A163A68CC29C6011A87521DCDC00B1F1A3D8B606
                                                                                                                                                                                                                                            SHA-512:679C4163ECE96C888D3B72926A1BD710C444A07290E60DEB274A7426B7850826650F3CAEF4338639881526F1C7FE179C12AF671C13BF24BB5E67052B37F23D88
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... .......................................}....@.............................D....0..(....@..Pu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.699948735964885
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FuwzJhn7KZHCCN08Gp6WDgxTJy0WppKPxh8E9VF0NyKNky:Fb7y3+yHy0WqPxWE8a
                                                                                                                                                                                                                                            MD5:4C826E19B27FC31A8141C1735A3A093C
                                                                                                                                                                                                                                            SHA1:E74FA47D26AB8A2C45E6DB2DB94E27FB84FA6437
                                                                                                                                                                                                                                            SHA-256:421DDAAB31E480790E5989E145C050010959E629702E3187870C12E451278A92
                                                                                                                                                                                                                                            SHA-512:0AC44BD5A24B05D49B08ADFCD53C7C5A45D97E8798A854AFDF9BF374438F657C56255C690BDF0837EA154ACB71DF83D0DF1491DEC7D5D4DFB9FE272AB507C593
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@..(w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pt-BR.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.66752824702996
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FGTbq/Zc+GZX8aF8zQJy0WCJ65Pxh8E9VF0NyL5:FuCFSy0Wk65PxWEd
                                                                                                                                                                                                                                            MD5:C5DA26E0E296C4C1666BF60B0CE16911
                                                                                                                                                                                                                                            SHA1:93D4C57699BF8AA981E3EBF8B33992F2CA45DE75
                                                                                                                                                                                                                                            SHA-256:5A04FEA91640E065F67F1427F171270CE769CB3E2155F340834C935783AAC634
                                                                                                                                                                                                                                            SHA-512:E6175D639071FD13F00ABB0C2B1876387899158CB824182783710C1177E18B5E02B18B70C0CE91F32F1367F8CA5C92F1E8D1F98BA6918D7312BD6ADE56D9FABC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...O.d...........!.........~............... ......................................-C....@.............................G....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_pt-PT.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.646340111209961
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FVEK+wstFNEx6ewBIiI2XhJy0WQGSPxh8E9VF0NyC2nEm:FVUMx/ULry0W0PxWE88N
                                                                                                                                                                                                                                            MD5:1ADDBCF6719F81E880737EF30CA89BE5
                                                                                                                                                                                                                                            SHA1:043C046AA3420339067C6DDFFBA253393057B0A3
                                                                                                                                                                                                                                            SHA-256:9E229B99EC1725BA355B7F905A46BD4C7D15DAE3A7FA5CF54A8C199B6BB572BE
                                                                                                                                                                                                                                            SHA-512:6931634D5096C236930FD4CA3C850D9DA325010DE96D99A7C26EEB9E7153DA7F4D3203F7D332820DE5F4D045296CDDBF9890EB6D157E27E82C46AA098EB6ECF7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................Da....@.............................G....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ro.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.668533720243672
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:FTnC1yNbMUB251BRHc871nDtCsy0WK4PxWEr:FTeBRHnRDLJ4Px
                                                                                                                                                                                                                                            MD5:0802BEFFB8CC1942F450403A83DAD91A
                                                                                                                                                                                                                                            SHA1:6BFE6CFCFDB789FE15365AD39AC60D7CFA782C31
                                                                                                                                                                                                                                            SHA-256:A15770A440E09967BBB25E4B8B326AE2596DD80F483CE12AA21678D0DBAD9233
                                                                                                                                                                                                                                            SHA-512:6F960C168536251F871F1FD3EB6E62AEA407DF0FE3218EBCEBEEE2CD5B3DE0675CDD874253F3259776B9338FFB9B6B4C608E769E21F9847C25600E3769B303BC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ru.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.876003031420293
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fm5y4uF44vKAvHdho4d283lmJy0WR22dPxh8E9VF0Nyvdz:FtZvHsFy0WnPxWEJ
                                                                                                                                                                                                                                            MD5:722B3E9E83D16481C12B803537F72AF3
                                                                                                                                                                                                                                            SHA1:D245E7A40305CFCA26A9EE4B95CB7C1859EBBDB8
                                                                                                                                                                                                                                            SHA-256:F44BBD97D7B300262AB1F9D4C918B3B980D41419E91669B04E36756A5683974D
                                                                                                                                                                                                                                            SHA-512:4A5A6DCF554C97885DA2632850CE380A7371264F78D0E268E34690E6820CDC2B7B671F7055709DD92A77291FF618FC9619308B89D4D7920F46CBFDE284FB00AA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...9.d...........!.........|............... ......................................GM....@.............................D....0..(....@..xs..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xs...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sk.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.69456859037089
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FpXaHdicuh+PiR6gLTPB2wJy0WELPxh8E9VF0Nysz9:FpQqjRjJy0WKPxWEy
                                                                                                                                                                                                                                            MD5:F8796BBEE22813BE0658163260FADA1B
                                                                                                                                                                                                                                            SHA1:F0AD54100A996E41011D9FFBE084CE7681299C9E
                                                                                                                                                                                                                                            SHA-256:8EE1C8984C63767959CD2ABC99BDBD860DA47B9D4B762982E045764F2FF56FE0
                                                                                                                                                                                                                                            SHA-512:8D9D3168D4D4A7E50AB856D3BB87CDABA5609B809BF0BDB9BFF00D7FD925B4AB750FA19DD9FD44131B46C72F87852D1FFC76144DF3F3CA450A0E173BFCB3C76D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@.. u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45544
                                                                                                                                                                                                                                            Entropy (8bit):4.657549160186828
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FuqToeST0shVyixlk5TpWBdf1i2IXouscM89Jy0WrTpKPxh8E9VF0Ny2WW:Fhv4lk5y1YZsAy0W0PxWEYP
                                                                                                                                                                                                                                            MD5:A7B4B48A39BFD0C344FE3D41545B76C9
                                                                                                                                                                                                                                            SHA1:B28B71015E1A3710F1C042291D398C6119FD48A7
                                                                                                                                                                                                                                            SHA-256:C828237E6C4C8623F1F2E9598A62936769355EE7BEA317460CE645CC7AF1D911
                                                                                                                                                                                                                                            SHA-512:1D15AA6913E32D7200055F8B29ADD8E5A2C4A9070B9CD906788E4DBCC5F5BD5FBC14E47805A051569AE51792C0065F8ED6F9414E968D466418B10056C0A541DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ......................................V_....@.............................D....0..(....@..pv..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...pv...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.872942179610346
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FWPbqSW7ixHUjY13tGPJzJy0WEtqkPxh8E9VF0NyBF:FKqOUjudGHy0WwPxWEb
                                                                                                                                                                                                                                            MD5:799B04C0C9700BAED67AE3AF641B8946
                                                                                                                                                                                                                                            SHA1:25050A1D302F6F3BAB291FAF07C7AFB147BD6992
                                                                                                                                                                                                                                            SHA-256:A77EC067351FEEB80B8F8375C98F993360CB52B7C5F90DA90A8C9A08CD544E5F
                                                                                                                                                                                                                                            SHA-512:D3D15D4BB99EB167040A319BA56797F718DA3FAB1CDF131E290F5A9A03876C9F41705820EC52E55686DE7FD5B1969ED7896888A2358FD41DB3588EBB63ECD58D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...K.d...........!.........~............... ......................................L.....@.............................D....0..(....@..Xu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sv.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.664578663662526
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F9a0GdxC7vc3ELOlJy0WcCDJjZ2Pxh8E9VF0NyP+/o:FRAxCDc3Eyy0WsPxWE9c
                                                                                                                                                                                                                                            MD5:CA50F99E4418798ADDA414C81118C2B5
                                                                                                                                                                                                                                            SHA1:2F24E7B5C81DF67236C1A692E3FF4091D10907F5
                                                                                                                                                                                                                                            SHA-256:C055262DE24BBC07462232258CB082C6E6D5FF1502CE2909B9CDA46CD27ABF75
                                                                                                                                                                                                                                            SHA-512:83C199505517CCA36FB86066C73DAF9C35611A5E58EEAD3F49AFF1631DEEB188CCBE7B671439CACC0904B3CDF9A7C8EAAE0CE371AFE14F4ADFD5D042D31D2C7A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_sw.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.694492393037756
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FnHdpqgicgiY7upv4M5IOyAeJy0WXaQPxh8E9VF0Nyz1R2:F9QQ07Gv4M5My0WJPxWEh10
                                                                                                                                                                                                                                            MD5:1DC167C856FE15596A907B56A5451F38
                                                                                                                                                                                                                                            SHA1:6803F563B7F78C6D7133FC1D2C6126EEA1D9FEBF
                                                                                                                                                                                                                                            SHA-256:E31B4E78C820A17124669D3A2B56C2373FD2C21BC5F0E87565C0AE8B5307E236
                                                                                                                                                                                                                                            SHA-512:18FDE8537E95411C9814DB12E780CA7AD4E6756A97F2CE05CC30653E2C4F3735BD09AF6D2F9C23BC6ED5DB09231D8070E1025738B8C0B32214E217CBCD250A13
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... .......................................F....@.............................D....0..(....@...z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ta.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47080
                                                                                                                                                                                                                                            Entropy (8bit):4.948448659499415
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fd08e0wcY51ZLm+4Lw3OTJJy0Wn+EsCLePxh8E9VF0NyK9Qm:FX5fY51ZLm+4Lw3wy0WXs+ePxWE8p
                                                                                                                                                                                                                                            MD5:F2827506727689200C75B134AF3A81B7
                                                                                                                                                                                                                                            SHA1:701B606A684B30BFA376F4F244582FF32BB9E6CF
                                                                                                                                                                                                                                            SHA-256:8831BDCD00FE1055E32CED62DBC3437612EE704FD331DF35D8ADF4450C95D3B6
                                                                                                                                                                                                                                            SHA-512:3069C2BFBE34E27A4309843B79585F89C44D0949F1EF51C3FBB79A91310CA8C8C9373E603E356AE1DA575A7D60A056FFAA2742AC356248A30C00BAB02B2AB680
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...4.d...........!......................... .......................................r....@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_te.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46568
                                                                                                                                                                                                                                            Entropy (8bit):4.900098776782017
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Fxfyhq1o45Z4aJALD61VJy0WVDPxh8E9VF0NyEc:FshGV5yaaLDiy0WFPxWEu
                                                                                                                                                                                                                                            MD5:C6A338676486B4405CBCFFD9E95B6DFA
                                                                                                                                                                                                                                            SHA1:6B7E2FE7EEDB08B289FC4DAB01BFB1EC648EC416
                                                                                                                                                                                                                                            SHA-256:EA52171A1BA9D431C9E4E99DB45EF64D5AAD5C224A80A731BBAC428D626360DC
                                                                                                                                                                                                                                            SHA-512:08C73FB7DAA69E6D7F5E3A23D1D5761EBE158A7863CC754F80EF7CEB57100E2337819F6733203121C85FB898002660298BD8B9221D96E5B1FA3D96CC22D05406
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!......................... ............................................@.............................D....0..(....@..Hz..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hz...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_th.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44008
                                                                                                                                                                                                                                            Entropy (8bit):4.898585189301246
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FAcYp+lrGsMKNMAcetNebrJy0Ww+w8Pxh8E9VF0NyHS2t:FaglrGszNMJetNmy0WttPxWEdXt
                                                                                                                                                                                                                                            MD5:921A76FC57260B64D56F85651968A802
                                                                                                                                                                                                                                            SHA1:DE76CBF4AEECB954EB67937D57FEA4D053AAA89B
                                                                                                                                                                                                                                            SHA-256:CE33AD0DBA4BEC40377B9ABFED4EE3C03CF1F159DB500F95366C377F6FE49664
                                                                                                                                                                                                                                            SHA-512:62BC3D4395562561A52E0A387454C631ADDE175AFDDAA3DE6084E0B55D89538AC49D3A7AC04EDDDB1E4013862AF9C3706D40EAF249443598A16B5521852DE00C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z.d...........!.........z............... ......................................#.....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_tr.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.710217028647626
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:F0Jp9ABk6qXQEdmvgh57GE+G9Ahrx++BzQSXjy0WebPxWEC8:F0JZhdmva7GESxLQK7fbPxt
                                                                                                                                                                                                                                            MD5:5BA91381EEAE1785BA89FC890808C7A9
                                                                                                                                                                                                                                            SHA1:CE3CD4E4007837F3A8D1629AA9366A0FAF4B2792
                                                                                                                                                                                                                                            SHA-256:B6B7B4A056D3449349BD0981B48AD1DCBC32AA5B41C4FF9B680F994D540744EF
                                                                                                                                                                                                                                            SHA-512:E8325BD2E545D322AD9627F6B631402A3868612B407C4F84CAD0B3C834EA0EA5D4ADF5DD88B7D539BC231B4651A5F2C0BFF1FC1D843005B1C96A56BB249D2DF0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........~............... ............................................@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_uk.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.886468370762969
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FNUVbL1KgHWyC2EeEWNXE/GfuyziJy0WlUPxh8E9VF0NyJTgk:Fy31luhy0W+PxWEH8k
                                                                                                                                                                                                                                            MD5:65C37B9914F7786AC7E3C3584C8F7A62
                                                                                                                                                                                                                                            SHA1:3B2D785698F96CC92A6AF481283406657FFF65E0
                                                                                                                                                                                                                                            SHA-256:9945A40CD5E0075A55A6691717D8A59C98BD85AE84E938041DD6EF5427A88B0A
                                                                                                                                                                                                                                            SHA-512:5005A480EA3243F8232B44BA091A66227AC10CA51219B9915923B7C394538BD498B33062C1E88316BBD84CEBBCDEF80B901014A8A595DED29BDDDF2F85904308
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ............................................@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_ur.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):45032
                                                                                                                                                                                                                                            Entropy (8bit):4.8564330106913625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FmQE7wL2A+OmAcoWu9OeeZyYGdJAAJy0W5ySxPxh8E9VF0NyVQcVfC:FkE2A+OmAcoWAOeesYRQy0Wg+PxWEXV
                                                                                                                                                                                                                                            MD5:CBAFB9B9B8760B0C3DBC3F0216C7513A
                                                                                                                                                                                                                                            SHA1:0A28C2BC915B06C549DDADD8A31FE0A912090155
                                                                                                                                                                                                                                            SHA-256:5E7C4916662FED930983ED046FF7DEF877F10D5375C510653C37A985BC547531
                                                                                                                                                                                                                                            SHA-512:5FE40E9A820C46055B0E9934C5A8BC2E43BE90396436CD076752696C8576E2212D0A5D15F4C149866FC68500410727C1D30A6F1EF55ABDC0CF96DEA2F2BB3AC8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...f.d...........!.........~............... ...........................................@.............................D....0..(....@.. t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_vi.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):44520
                                                                                                                                                                                                                                            Entropy (8bit):4.771867334398084
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F+SM5fQghFjncDyv4Jy0WAWBQHPxh8E9VF0NyDff1R:FzYfDhVc5y0W3OPxWEh1
                                                                                                                                                                                                                                            MD5:C34505DD2FAE316B795AE2D1E934AFB0
                                                                                                                                                                                                                                            SHA1:864A67B9017573DD438AE321210ED720C454184C
                                                                                                                                                                                                                                            SHA-256:0AF644546C66B952795B0A7D05AFCCFE87E9D572073C99F8CDCF146EE5705857
                                                                                                                                                                                                                                            SHA-512:00B2FDCFE24CD17C7418E471BEC762F235669E0DB35D05D2023E155D0B543F65BA1115450D01FC5D02177AAA2CDAF10CC640506E6CEAB716F0C4F2ED44D7767E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........|............... ............................................@.............................D....0..(....@...s..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_zh-CN.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):38816
                                                                                                                                                                                                                                            Entropy (8bit):4.841517965818435
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F5xjPSJshAFBMHwzJy0WKGPxh8E9VF0Ny/NU:FrpAFBTy0WvPxWEJa
                                                                                                                                                                                                                                            MD5:2BE99DBDE29BAB1363E5848B84362E23
                                                                                                                                                                                                                                            SHA1:3149C9598CE3CB29EA0E756C9E12DCECB8628283
                                                                                                                                                                                                                                            SHA-256:B5927FB9699C79D77B1D49F322BACE29801776CCEE4F91EECAE00F04F6431396
                                                                                                                                                                                                                                            SHA-512:44E66C99747F6857883585653894F333B638A4A19AEBD1C9CEF6D264064EFAFD7A77FDED06F5F5C14F0E489E2555D17576EE3152E347CC74B8BC7E5741F3A5A8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L.....d...........!.........f............... ......................................c.....@.............................G....0..(....@..`]..........Hl..X+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...`]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\goopdateres_zh-TW.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):38816
                                                                                                                                                                                                                                            Entropy (8bit):4.854603942594096
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:F++/JutGmmBdcJy0WsinPxh8E9VF0NygBjY:FNATy0WjnPxWEKK
                                                                                                                                                                                                                                            MD5:2667B44345F8C493F41C9C65B2B40B70
                                                                                                                                                                                                                                            SHA1:0969DC5411520E3FDC242D6D1F5289DC69218526
                                                                                                                                                                                                                                            SHA-256:3BEE374E97F8C0A2EDA5A6509CBFE21B4DC3BB9E0CAC62CA908F8EB049A3EFEC
                                                                                                                                                                                                                                            SHA-512:8D746F5AA6A21EC1FBB05E35554396BCD0E017CED7D65409D721B75CC4DB04FE7FA944F4122C1BE1E6AEF47E1DEADDF444A943BF9D5632E906BE123013B85ECA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...P..d...........!.........f............... ............................................@.............................G....0..(....@...]..........Hl..X+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\npNortonBrowserUpdate3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):519152
                                                                                                                                                                                                                                            Entropy (8bit):6.796206581178465
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:bcP2nPG96akIIm7D0W1IK+K2XaTPwKwJIC:AP2n+96WD0vWoaTYKwJ
                                                                                                                                                                                                                                            MD5:6B3F50DD9E9D077CD50902BF1B79427C
                                                                                                                                                                                                                                            SHA1:32B57A6452CABF75DC4162EE026D396A13933955
                                                                                                                                                                                                                                            SHA-256:9CC9D08D8E71D15E15D32B2A5DE58766A7DBFFEA37F476A739A42231C26A2777
                                                                                                                                                                                                                                            SHA-512:5856C0B791F93E4DB5C0950568C45BCC3D132466661B7A9C1B85C21ADBEA91EB5C9744E67F5CF2877F934DA3C278550D7FDE294A6CAEAFC634CBCE71DBA40EC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........iI..'...'...'..}"...'.rx ...'.rx!...'.rx$...'.rx".Z.'..T...'..}#...'..}$...'..}"...'.rx#...'.rx&...'...&...'..}....'..}'...'..}...'..}%...'.Rich..'.........................PE..L......d...........!....."..........[........@............................... ............@..........................=.......>..........h...........H....;......8I...&..T...................@(......H'..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data....I...`.......8..............@....rsrc...h............J..............@..@.reloc..8I.......J...f..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psmachine.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):396216
                                                                                                                                                                                                                                            Entropy (8bit):6.6364472604888975
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:n4bSrQpVFWtouGV7AstKS4rHICzoHz25HxPqJKCJAOFbr0uY6ckgOdi:qSUpVF64XsS4rHIC7qVJz0eHLi
                                                                                                                                                                                                                                            MD5:8648A09E9EB09453D7153101E25F8FCE
                                                                                                                                                                                                                                            SHA1:B55B5E28317A5F1452BCBAC2704747B3DC4483D3
                                                                                                                                                                                                                                            SHA-256:BE8DB74FBEF1CD2EEE7C2A8957B33634913EEA9CBD20B1E875B95878BBFBC42A
                                                                                                                                                                                                                                            SHA-512:57BFF27A142062691507B1D99AB8086FACEFC3A211484B97281964F615F2C5259760622FA83155F4198BB48E3D2B54795B4E316D9156C293939D318ED959CDC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L......d...........!.........................................................0.......[....@.........................P3.......4...........V..........H...p7......L5......T...................@.......h...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psmachine_64.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):521784
                                                                                                                                                                                                                                            Entropy (8bit):6.353157166068969
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:lcYznGwe1OMgciIogFK/IMakdTv4aU5i2s1uEn0ToohzmVj50ZfxA6ckV:bnSgciKFK/IMakZvvClDE0TooU10xH
                                                                                                                                                                                                                                            MD5:29991826BE3385C3A92B49F672F92026
                                                                                                                                                                                                                                            SHA1:9F16C72BA044E378167F631C41CE1B3D818E0806
                                                                                                                                                                                                                                            SHA-256:7FCEBD4FF83566305500F9BFDD342EB57C502B427A12EF281092FAB94E142827
                                                                                                                                                                                                                                            SHA-512:F525CDF3EA0B77CCA0475433E6DF3A577F76479C0B6BECCC0B41A147D9372A4BA8586D84FB0ADC5660A4BC28359DACCBE76691C604748AC56991210E344D748F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d...M..d.........." ................(........................................0............`.........................................`....................V...`...9..H....;......(......T.......................(...P...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata..Z....0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............J..............@..@.rsrc....V.......X...L..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psuser.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):396216
                                                                                                                                                                                                                                            Entropy (8bit):6.636012823818412
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:S4bSrQpVFWtouGV7AstyS4rHICzoHz25HxPqJK7JAOY1r0Oc6cOgOdi:dSUpVF64XMS4rHIC7qIJW0ypLi
                                                                                                                                                                                                                                            MD5:737520D5A13D92E1210CBFFFC64C109D
                                                                                                                                                                                                                                            SHA1:F6677A3AA960225DBE682678289FBFFE4AF3C9CC
                                                                                                                                                                                                                                            SHA-256:6A59B47E916C73C046D604956A050CC5AF9A0C96D1DAE51CD8ABDEE17F273085
                                                                                                                                                                                                                                            SHA-512:89BD770D565553ADA2123CAFDBCB3443E5B304BF0D0EE901CE2DE0E7C6245B08162F2FE39C7FCFC1A7908105A3A00DF3BD8DD3EA0CE13F96C91DAF21EAE2155B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L......d...........!.........................................................0.......d....@.........................P3.......3...........V..........H...p7......L5......T...................@.......h...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\psuser_64.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):521784
                                                                                                                                                                                                                                            Entropy (8bit):6.352828173572569
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:ZcYznGwe1OMgciIogFK/IMakdTv4aU5i2s1uEn0Tooh/RYD50Zfx86cSAj:HnSgciKFK/IMakZvvClDE0TookV0xr
                                                                                                                                                                                                                                            MD5:4FBD1394EEAA4D5F7BD66AFDC6FA088C
                                                                                                                                                                                                                                            SHA1:8D09DC6A9C06A8B549273BF121E7D3D41E8929CC
                                                                                                                                                                                                                                            SHA-256:7A9F75B840515009ABDA7BCA9372C97C5514E32D0324A2D01A7FE377A3889762
                                                                                                                                                                                                                                            SHA-512:089160F6D4AEE7A1C6C550F256BF52573A71E8CDCBFF19AA829618DC1D29B772288CA76A270001DA09B19BFA175DC20829607F9C3035C672D2289550927371F7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d......d.........." ................(........................................0............`.........................................`....................V...`...9..H....;......(......T.......................(...P...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata..Z....0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............J..............@..@.rsrc....V.......X...L..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):440608
                                                                                                                                                                                                                                            Entropy (8bit):4.477495049012643
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:TjbidjsOQe3H/lqa8ggDemWSzuwJWwqjPpiIFWNjdkjAGAOK0Lxmb9rvp3AzAwBv:ytqa8VxJMReTixcvcF4fZNVw
                                                                                                                                                                                                                                            MD5:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            SHA1:B267CCB3BBE06A0143C1162F462839645780D22E
                                                                                                                                                                                                                                            SHA-256:66E75EA8A3641E419D5226E062F8F17624AFBEE3D7EFD1D6517890511E7111D9
                                                                                                                                                                                                                                            SHA-512:512F2C2BE5EE5F61F31719344CD20DD731898C5B63F6E1ABDBFC81821533D93AE06C96F256AC1196E9F457A927C4AA61C35D00B45181793547FF3B6670866CCA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.<r..R!..R!..R!..Q ..R!..W ..R!..V ..R!B.V ..R!B.Q ..R!B.W <.R!..S ..R!..S!s.R!H.[ ..R!H.!..R!...!*.R!H.P ..R!Rich..R!........PE..L...b..d.................<...L......;z.......P....@......................................@.................................`q..x...................H....8...........^..T...................@_......X^..@............p..\............................text....:.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc................T..............@..@.reloc...............n..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):33688
                                                                                                                                                                                                                                            Entropy (8bit):7.20956664617613
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:zVYdpNkp9TvDXy2XmVEV3GPkjVvDXy2ulqwVEV3GPkjL:zVY1+nCDOEECDbOEw
                                                                                                                                                                                                                                            MD5:4ACE42D6530AF699FEB2372F805A6A40
                                                                                                                                                                                                                                            SHA1:FB8C7352808F104E851468F25D0DD14A25B8CFCA
                                                                                                                                                                                                                                            SHA-256:13DCE393B59B9EF4A5D4FCDC27267D018B350BDC44A62AACC5DBC7F1DF7F7A1C
                                                                                                                                                                                                                                            SHA-512:8BB770F304CD8BA23FB2A64370D74AC3FDC134235FF39802983B9BABDE12AB00E49A746F3C2113520F0E135CDFD1473C0B4B64272279D13E576912126AA556D2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0............."3... ...@....... ....................................`..................................2..O....@...................g...`...... 2..8............................................ ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H........"..............................................................R..{....o.....o....&*&...}....*..0............r...p(......,.....r...po.......8.....{.....o......{....r...p(........,..{.....{....o.....r;..p(.......{..........%...o......o....o...........,e....+F....o......o....o........(....rI..p.o......o....o....(....o........X.....o....o..........-...+....+..*..(.......s ...}.....{.....o!.....{.....o"....*.0............|....(#.....,..|....($....*....0..............(%..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):399264
                                                                                                                                                                                                                                            Entropy (8bit):6.025523802176381
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:G0N02KsbnIU70vYrRHAjC0Y0glwgugEnoSE5jq:U2tIUYArRv0Y0glwgugEnoSE5jq
                                                                                                                                                                                                                                            MD5:F921416197C2AE407D53BA5712C3930A
                                                                                                                                                                                                                                            SHA1:6A7DAA7372E93C48758B9752C8A5A673B525632B
                                                                                                                                                                                                                                            SHA-256:E31B233DDF070798CC0381CC6285F6F79EA0C17B99737F7547618DCFD36CDC0E
                                                                                                                                                                                                                                            SHA-512:0139EFB76C2107D0497BE9910836D7C19329E4399AA8D46BBE17AE63D56AB73004C51B650CE38D79681C22C2D1B77078A7D7185431882BAF3E7BEF473AC95DCE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.......................P....)...-................@.......................... ..................................................d........................k..................................P.......................0................................text...P........................... ..`.data....).......*..................@....rdata.............................@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\CheatEngine.chm (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows HtmlHelp Data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):306758
                                                                                                                                                                                                                                            Entropy (8bit):7.936079952495831
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:/UuFqUYSsTDiKebI7F03RPf2rB84daXcXrcURJo8tGgqQdB5+cbsQe/zQXE9LA2:tFhYSsnl0I7FG8S4daC/RGg1bnerQILf
                                                                                                                                                                                                                                            MD5:BB80FEC3B6E843B61859914480706CD9
                                                                                                                                                                                                                                            SHA1:0CED874BEE5BDA6059B5195911AA117693D9D2DE
                                                                                                                                                                                                                                            SHA-256:2D52F9D59211F8906ACE16525721B1400343BDF720F062CF111D84089F129009
                                                                                                                                                                                                                                            SHA-512:78D8A024DABD111B59BEEA4DC21150C7FBB3A6924201D2F3FF9E720E4BBC967BBFF285BA2064BC35C260FFDE433C639FDC0252C47AE29B43398117EDA21CF648
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:ITSF....`........2.........|.{.......".....|.{......."..`...............x.......T0.......0..............F...............ITSP....T...........................................j..].!......."..T...............PMGLS................/..../#IDXHDR..t.../#ITBITS..../#IVB...B.,./#STRINGS...O.r./#SYSTEM..v.6./#TOPICS...t.../#URLSTR...t.[./#URLTBL...t.../#WINDOWS...2.../$FIftiMain...<..8./$OBJINST...}.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...y../$WWKeywordLinks/..../$WWKeywordLinks/BTree..z.L./$WWKeywordLinks/Data...F.../$WWKeywordLinks/Map...G../$WWKeywordLinks/Property...Y ./0-ptaddresslist.html...8.S./1-ptmemoryview.html......./2-ptondebugevent.html...".../3-ptprocesswatcherevent.html...;.i$/3Dpinballforwindowspointercode.html.....s /4-ptfunctionpointerschange.html...$.2./5-ptmainmenu.html...V.]./aa_addextracommand.html...v.../aa_removeextracommand.html......./About.html...q."./Aboutb1.JPG...*.i./AboutCheatEngine.html.....U./Aboutthedebugger.html.....V./address.html...9.../Ad

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):183200
                                                                                                                                                                                                                                            Entropy (8bit):6.842191242335636
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KAm/u5ImKJacvUOQC2mCDiGuTEG2BiERGNcCYOqtwyROYeoHVP0bkHnP0z:Niu5MJa9hZun2BiERaEwyOM2Qsz
                                                                                                                                                                                                                                            MD5:F1C9C9A8B035DA9385D88CA34CD49305
                                                                                                                                                                                                                                            SHA1:77E48F73C224949EC8BD8A32087609B7BF217E94
                                                                                                                                                                                                                                            SHA-256:4168D6408994A297665AEEA68ABB6C062D58EA00851751959557E7F8A8BAC17D
                                                                                                                                                                                                                                            SHA-512:D7BD2FC8592E18CA46CDF1DC74496CF3CB5EF991F4BD9E141DEEABA0F665E731A5953CAAF1CD39859817EB6D0C1B77700FE08EEED15320757B3FA36D798C4C7B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cK..'*..'*..'*....[.-*....Y..*..uB...*..uB..6*..uB..5*....X.=*....a.,*..'*..V*...C..!*...CU.&*...C..&*..Rich'*..................PE..L....(.c............................$U............@.................................(D....@..................................F..x....p...............`...k......d....7..p............................7..@............................................text............................... ..`.rdata..^...........................@..@.data........P.......@..............@....rsrc........p.......J..............@..@.reloc..d............L..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\DotNetDataCollector64.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):210336
                                                                                                                                                                                                                                            Entropy (8bit):6.575377720318411
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:vWMJUr2f2Im9kj/FqgmHpJ1/YCVuIB9Vxv7bn1UC9gfkCeEWHFP0jHzP0Q:vWc02f2R6FqgoJ1boIPRUsfGjQQ
                                                                                                                                                                                                                                            MD5:A2C0B5D0D9E5C2A2C774E8B587850447
                                                                                                                                                                                                                                            SHA1:C8AA4CB01676D57B34AAB22C7FD018B63DFF6892
                                                                                                                                                                                                                                            SHA-256:F0F3D0FAD632D9DDAC8FF0B4EAEC20094FA0F9ABDDF784954DFBB0723A997F21
                                                                                                                                                                                                                                            SHA-512:85F4AEB562424ABF0E2BC5EDE0CDF0052FBB15E7DF70F691C11B06171A8A45A6672C2C688CD5B6FFEBEE16C36FDAC7978E39CA04F8C29F75D588D2ACA3599395
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..........rZ.....rX.:..................rY....f.`..........(......(.T....(......Rich...........PE..d....(.c..........".................<X.........@....................................^.....`.................................................L...x........................k..............p...............................................(............................text............................... ..`.rdata..............................@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):242616
                                                                                                                                                                                                                                            Entropy (8bit):6.432754517349666
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Bj9mOBuELLZXBJPCR6ygny56rs+iO2AwCNCtALb44TPk3Ap1rleY/DptNH/P0uHV:fn7LhBJ9W56A+iOlfN/LbZnbptN0uZH
                                                                                                                                                                                                                                            MD5:9AF96706762298CF72DF2A74213494C9
                                                                                                                                                                                                                                            SHA1:4B5FD2F168380919524ECCE77AA1BE330FDEF57A
                                                                                                                                                                                                                                            SHA-256:65FA2CCB3AC5400DD92DDA5F640445A6E195DA7C827107260F67624D3EB95E7D
                                                                                                                                                                                                                                            SHA-512:29A0619093C4C0ECF602C861EC819EF16550C0607DF93067EAEF4259A84FD7D40EB88CD5548C0B3B265F3CE5237B585F508FDD543FA281737BE17C0551163BD4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........H..................$...t.................@.............................................................................d....................H...k..................................P.......................4................................text............................... ..`.data...$...........................@....rdata..............................@..@.bss....t....P...........................CRT.................,..............@....idata..............................@....rsrc................:..............@.../4......$............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\Tutorial-i386.cepack (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1112834
                                                                                                                                                                                                                                            Entropy (8bit):7.995534990823338
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:H1XCCswrgMlbH4v3Cj6N3yHORtmV7VJPX/uPQDNDcpLwBlxaZm5g5Gvh6at0:ACRlbHhj6N3vR4Vt/uSN2L6LaZAgcvHC
                                                                                                                                                                                                                                            MD5:38B22DEDFBCAFE1376ACEB7A0722FB8F
                                                                                                                                                                                                                                            SHA1:6C96AA4E7C71C82A82951443BA6DAE9019601E55
                                                                                                                                                                                                                                            SHA-256:F092D81531B8603A52F70245D041E2C43B020280BD9F358172330FF405E451CD
                                                                                                                                                                                                                                            SHA-512:135EF19161572A57AE1BC618C6CC7FDE889BD1A5C88E6125080C3712E7F0AE96F2A9B7728765C1B115F91CE48200CA47CA0C43E31625CBD11DFFA181610F03CA
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:CEPACK..&..}|T.7~Nf.L...@..".2(..Di....M#.....(meJ.(7...'..'.f.0.k..V.....k...QQf...HqB(N.b@jO.T..&C.2...93.....y>...=s.w.....k...R..zN.q...H..8._....U.3i.[...i.........5{K.3.-.....|...g.{cv..t....^..U..yb..'...4JD.[...I...t.x]f...c.y#8.....U..;I.....ro....M..Qo..?&.....g......|.?.^w#......%@OV.wO....r.x..7.#.PFJP...B...9n.O|..-.F>.w....1...[.....^6..q......p..~{.V..<-Xp.z..z....m..........=5......n.......}..).....x...........,.m...0......1.....>..^._d...~...<.........b=...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...Q..3..`#.M..dp..g38..f./d.b..2x...2x.........^.....f.z.o`..........v..`p9...\..Z..dp=.w1.E..e.>..g...70. ...|.....ap;.;..c.)...|......`.....2x..!.....c.7...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...q..3..`#.M..dp..g38..f./d.b..2x...2x...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3403192
                                                                                                                                                                                                                                            Entropy (8bit):6.035185815441339
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:ar2V9BrWblVbqS1+Cxz0MB95D//ocnaMo6WuDgRPZO/Y12y6Pu:aqV9BqzbqSR009StqG
                                                                                                                                                                                                                                            MD5:1C1630B241D5A6BE07BFBA2B3EA97A25
                                                                                                                                                                                                                                            SHA1:7203255D1A6021874D41A48FCD5719FD7034F34C
                                                                                                                                                                                                                                            SHA-256:526CDDD0D843F5984AC6CB98D28F22B090682C3A8704122B644EC8AE2C9A10E5
                                                                                                                                                                                                                                            SHA-512:BDDEDB575FEBF8C8103CFBB1981FD1D5F20D2E0F1D6F4252A98930D587420A69750DDC1BE46932CDF979B8633054321F462557D88349459E111BE43139BEFF4A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........3......./..... z..tN...j..0,.......................................@4.......4.......................................................2.......2..3... 0.......3..k..................................p...(.....................2..............................text... z.......|.................. ..`.data...tN.......P..................@....rdata...7....!..8....!.............@..@.pdata....... 0.......0.............@..@.bss.....j...02..........................CRT..........2.......2.............@....idata...;....2..<....2.............@....rsrc....3....2..4...L2.............@.../4...........04.......3.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\allochook-i386.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):336600
                                                                                                                                                                                                                                            Entropy (8bit):6.344264969706984
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:6LYEDJlXw5pAnHp2ukwTX6N8B4A84zMtEl1knxgaPZ3nbanlYZn2l1S2CAYOpIOs:6LYEDJAAnHp2uk2KNO0tEQV+b3n6
                                                                                                                                                                                                                                            MD5:19D52868C3E0B609DBEB68EF81F381A9
                                                                                                                                                                                                                                            SHA1:CE365BD4CF627A3849D7277BAFBF2F5F56F496DC
                                                                                                                                                                                                                                            SHA-256:B96469B310BA59D1DB320A337B3A8104DB232A4344A47A8E5AE72F16CC7B1FF4
                                                                                                                                                                                                                                            SHA-512:5FBD53D761695DE1DD6F0AFD0964B33863764C89692345CAB013C0B1B6332C24DCF766028F305CC87D864D17229D7A52BF19A299CA136A799053C368F21C8926
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!...G.3..D....G...C.......P.......................................E...............................P.......@..P...................@....g...`...$...................................................A..t............................text....3.......4.................. ..`.data...D....P.......8..............@....rdata...a...p...b...L..............@..@.bss.....G...............................CRT.........0......................@....idata..y....@......................@....edata.......P......................@..@.reloc...$...`...&..................@..B.stab... ...........................@..B.stabstr............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):479536
                                                                                                                                                                                                                                            Entropy (8bit):5.994666279988566
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:Tch6UtcJYg8yRAkB+vsoqOvfkv+y3ilZkaCeMG:e6Utc6gdcfkv+KIR
                                                                                                                                                                                                                                            MD5:DAA81711AD1F1B1F8D96DC926D502484
                                                                                                                                                                                                                                            SHA1:7130B241E23BEDE2B1F812D95FDB4ED5EECADBFD
                                                                                                                                                                                                                                            SHA-256:8422BE70E0EC59C962B35ACF8AD80671BCC8330C9256E6E1EC5C07691388CD66
                                                                                                                                                                                                                                            SHA-512:9EAA8E04AD7359A30D5E2F9256F94C1643D4C3F3C0DFF24D6CD9E31A6F88CB3B470DD98F01F8B0F57BB947ADC3D45C35749ED4877C7CBBBCC181145F0C361065
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................& ...G.......XJ..P................................................................................................`.......P..P...............t1.......g...p..(...................................................`S...............................text.............................. ..`.data...............................@....rdata..............................@..@.pdata..t1.......2..................@..@.bss....XJ...............................CRT.........@......................@....idata.......P......................@....edata.......`......................@..@.reloc..(....p......................@..B/4..................................@..B/16.................................@..B/30.................................@..B/42.....@...........................@..B........................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\DotNetInject.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8088
                                                                                                                                                                                                                                            Entropy (8bit):5.172167677485522
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:zuiTTPEYya1gq5jfFEYQhRIA03xB97cq1fvhEN:ztTzyapKRiG
                                                                                                                                                                                                                                            MD5:B5AE011C70C1D26CC31A5D818D60E53C
                                                                                                                                                                                                                                            SHA1:7BE6AD86FCC9208D6F21B9F1D464B6334E64922B
                                                                                                                                                                                                                                            SHA-256:31ED4209776DBFAD74EC811326439D26C02B6AB653056D5E171D952C12D3F25B
                                                                                                                                                                                                                                            SHA-512:440B1AFC72D671D8AA663B6672371AC365029525EE055CF380A9C9C84625FD5FA2B328110633A183F87CECF8D1D2CACB62E49A7EB382B30AAA75DA5B3D2F3054
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--[[..You have a d:\bla.dll with namespace ClassLibraryX, with a class named "MyClass"..That class contains a function defined as:..public static int MyInitFunctionName(string parameters)....then you do: injectDotNetDLL('d:\\bla.dll','ClassLibraryX.MyClass','MyInitFunctionName','Something')....--]]....local DotNetCoreInjectScript=[[..[enable]..alloc(injectdotnetdll, 2048)..alloc(IID_ICLRRuntimeHost4,16)..alloc(RuntimeHost,8)....alloc(paramstr,256)..alloc(methodname,256)..alloc(classname,256)..alloc(dllpath,512)....alloc(returnvalue,4)..alloc(errorvalue,4)..label(error)....dllpath:..dw '%s',0....classname:..dw '%s',0....methodname:..dw '%s',0....paramstr:..dw '%s',0......IID_ICLRRuntimeHost4:..db 66 d3 f6 64 c2 d7 1f 4f b4 b2 e8 16 0c ac 43 af....injectdotnetdll:..[64-bit]..sub rsp,6*8+8..mov rcx,IID_ICLRRuntimeHost4..mov rdx,RuntimeHost..[/64-bit]....[32-bit]..push RuntimeHost..push IID_ICLRRuntimeHost4..[/32-bit]....call GetCLRRuntimeHost..cmp eax,0..jne error....[64-bit]..mov rcx,[Ru

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\DotNetInterface.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20837
                                                                                                                                                                                                                                            Entropy (8bit):4.996731854830045
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Rmi4uQRgQgAgm2+CXgSKgKghmg60gGg4tgKplg/Dhrf+1e5l7jTRgzKgIgmoJMQZ:y3KQBHvSo9a452TZ0YgkP
                                                                                                                                                                                                                                            MD5:04CDE30D6AA9999A846B5FC3CFC1F56C
                                                                                                                                                                                                                                            SHA1:2187AB73161EE8A516D25F8295BB4C7E3DA2F7E3
                                                                                                                                                                                                                                            SHA-256:EAE2A91808BB58B386F3BDDE75176C7208C22BF5515C5D6E467C583DF2E72E15
                                                                                                                                                                                                                                            SHA-512:FB2F27F3981E587DDD379D54999067092DC2FBE2F243E4A49B2F9D4DA172907D169BC708AA0840631C951FB01CCB9E69A403EB2E19A5F1AFF1BE3FF0EEC27C62
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview: ..--same as monodatacollector but for .net and .netcore..--can theoretically be used on mono as well....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetforceddatacollector.po')..end......local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....dotnet_timeout=3000....DOTNETCMD_TEST=0..DOTNETCMD_INITMODULELIST=1..DOTNETCMD_GETMETHODENTRYPOINT=2..DOTNETCMD_GETFIELDTYPENAME=3..DOTNETCMD_GETFIELDVALUE=4..DOTNETCMD_SETFIELDVALUE=5..DOTNETCMD_LOADMODULE=6..DOTNETCMD_GETMETHODPARAMETERS=7..DOTNETCMD_WRAPOBJECT=8..DOTNETCMD_UNWRAPOBJECT=9..DOTNETCMD_INVOKEMETHOD=10....DOTNETCMD_FIND_MODULEID_WITH_CLASSLIST=11......DOTNETCMD_EXIT=255......dotnetmodulelist={}....function dotnet_findDotNetMethodAddress(namespace, classname, methodname, modulename).. --print(string.format("dotnet_findDotNetMethodAddress('%s','%s','%s','%s')",namespace,classname, methodname, modulenam

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\addtonewgroup.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2018
                                                                                                                                                                                                                                            Entropy (8bit):4.845505891620365
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8LRZCSs+dJPHoSLI0zAXFqfzhPR3sAuH7vMTCRTnoH7ADR09ZWgsAU1HTfHU1EP:IRZ7umKgl5s2+cZPs81u
                                                                                                                                                                                                                                            MD5:3E20F1013FB48A67FE59BEDE7B8E341B
                                                                                                                                                                                                                                            SHA1:8C8A4CB49C3B29DB2C47F84AAFD0416101722BFE
                                                                                                                                                                                                                                            SHA-256:96E4429192F9AB26F8BF9F9429F36B388AA69C3624781C61EA6DF7E1BCA9B49B
                                                                                                                                                                                                                                            SHA-512:99CF3F88C8B06DA0DBE8085DEE796BEC7A9533990A55FBCE7524A4F941B5ECF0E8EC975A4B032EB2AAABD116C0804995A75036C98A5E4058F25D78D08A11F3F2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local pm=AddressList.PopupMenu..local pmAddToNewGroup=createMenuItem(pm)..pmAddToNewGroup.Caption=translate('Add to new group')..pmAddToNewGroup.ImageIndex=MainForm.CreateGroup.ImageIndex..pm.Items.insert(MainForm.CreateGroup.MenuIndex, pmAddToNewGroup)....local oldOnPopup=AddressList.PopupMenu.OnPopup..AddressList.PopupMenu.OnPopup=function(s).. if oldOnPopup then.. oldOnPopup(s).. end.. pmAddToNewGroup.Visible=AddressList.SelCount>=1..end....pmAddToNewGroup.OnClick=function(s).. local i.. local count=0.. local selcount=0.. local withAddress=false.. local hasAddressSupport=false.... if AddressList.SelCount==0 then.. messageDialog('Please select at least one entry first', mtError, mbOK).. return.. end.... hasAddressSupport=AddressList[0].IsAddressGroupHeader~=nil.... for i=0,AddressList.Count-1 do.. if AddressList[i].IsGroupHeader then.. count=count+1.. end.. end...... local groupname=translate(string.format('Group %d',count+1)).. if (isKeyPressed(VK_

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\alternateSpeedhack.LUA (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7632
                                                                                                                                                                                                                                            Entropy (8bit):4.883983761190223
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:peDFQNTce2Qt5q/sn2Wdk7RlxJKTiZjYsfUv:p3ue2F7RlxJfYP
                                                                                                                                                                                                                                            MD5:459B793E0DC43A993F03D8B612F67CEC
                                                                                                                                                                                                                                            SHA1:F14AE9AFBE97AF534A11BF98AC1CC096269F1474
                                                                                                                                                                                                                                            SHA-256:E2CBB4C2F46305BB07D84222231012FD4C800FE8E1B43E0AA1AF9B6C5D111F7F
                                                                                                                                                                                                                                            SHA-512:1740068E3419D153ECBD9D1A6AADA20AABE71915E7422DCE1A83E616E8D2A1084922A81741591A682531E1F8146E437D8688521C7707A4909E5721768A3F956E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Copyright Cheat Engine......local function getOriginalCodeAndFiller(address).. local original,filler.... if type(address)~='number' then.. address=getAddressSafe(address).. end.... if address==nil then.. return nil, 'invalid address'.. end.... local sl=createStringList().. local d=createDisassembler().. local size=0.. while size<5 do.. d.disassemble(address).. local ldd=d.LastDisassembleData.. local inst=ldd.opcode..' '..ldd.parameters.. sl.add(inst).. size=size+#ldd.bytes.. address=address+#ldd.bytes.. end.... original=sl.Text.. if size-5>0 then.. filler=string.format("nop %x", size-5).. else.. filler=''.. end.... sl.destroy().. d.destroy().. return original,filler..end......local function hookSpeedFunctions().. if speedhack and speedhack.processid==getOpenedProcessID() then .. return true.. end.... local result, data=autoAssemble([[.. alloc(speedhack_wantedspeed,4).. registersymbol(speedhack_wantedspeed).. speedhack_w

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\autosave.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9243
                                                                                                                                                                                                                                            Entropy (8bit):4.766574177681985
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C64/8dXYKgLNhpwHmFUazyI+Q4Om1q/Qt:t4nHUKUa0Out
                                                                                                                                                                                                                                            MD5:40D6BFE593194CF938E19622A3C13A5E
                                                                                                                                                                                                                                            SHA1:761257E8EF492431CF0E04DBCA396FABB25FE1AE
                                                                                                                                                                                                                                            SHA-256:C4CEF60489B067C8E7ABCDD5594643A27D0720B21523753DD462D53024287116
                                                                                                                                                                                                                                            SHA-512:1D1AAA9DE74B0BB08CC4CECED5DBFA4C589347EAC098D7AE013D5A1BEAAE0EEACA4D314E2591560C6DF14A93DD4E9316CA317D21EFADCCA57D11EEE72F4C6E16
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'autosave.po')..end....require("lfs")....autosave={} --todo make local....local AutoSaveSettings=getSettings('Auto Save')..local AutoSaveVersion=1....autosave.getPath=function().. local path=AutoSaveSettings['SavePath'].. if (path==nil) or (path=='') then.. .. path=os.getenv("LOCALAPPDATA").. if (path==nil) or (path=='') then.. path=getCheatEngineDir() --last attempt .. end.. end.. .. if string.sub(path,#path)~='\\' then.. path=path..'\\'.. end.. .. return path..end....function autosave.saveState().... .. local pid=AutoSaveSettings['ProcessID'].. if pid and pid~='' then.. pid=tonumber(pid).. if pid~=getCheatEngineProcessID() then.. --another CE has done an autosave.. if getProcessList()[pid]==nil then.. --it doesn't exist anymore... messageDialog(translate('Another instance of Cheat Engine has crashed and it created an autosave. Autosave disabled until y

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\bigendian.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7917
                                                                                                                                                                                                                                            Entropy (8bit):5.014591940837417
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:sQJpltyKlR4ZtoOQ9pttWKlR4vtGTQPpMlyFuVCQc6c0RhBmg:stKY59KYQ5JhUg
                                                                                                                                                                                                                                            MD5:E76FCD2ECD5B956D4579A676AA3EEA01
                                                                                                                                                                                                                                            SHA1:49ECBA5CCC531A40AD7805A126D38B44B4A36576
                                                                                                                                                                                                                                            SHA-256:0339BA0043AF5C058CF3A19DE9F90312D18F6BB2728F454EF403B531BD57AE42
                                                                                                                                                                                                                                            SHA-512:8443C213D4A626A358631F76A0CC4C106543CE58C94D34A96B88574B3E32AE742F28878B259A17823CA07EC521B06E32E572E7BC77E10951BC0984B07C0571C6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local scripts={}....local function registerBigEndianInt16()..scripts['2 Byte Big Endian'].type=registerCustomTypeAutoAssembler([[..alloc(TypeName,256)..alloc(ByteSize,4)..alloc(ConvertRoutine,1024)..alloc(ConvertBackRoutine,1024)....TypeName:..db '2 Byte Big Endian',0....ByteSize:..dd 2....//The convert routine should hold a routine that converts the data to an integer (in eax)..//function declared as: stdcall int ConvertRoutine(unsigned char *input);..//Note: Keep in mind that this routine can be called by multiple threads at the same time...ConvertRoutine:..//jmp dllname.functionname..[64-bit]..//or manual:..//parameters: (64-bit)..//rcx=address of input..xor eax,eax..mov ax,[rcx] //eax now contains the bytes 'input' pointed to..xchg ah,al //convert to big endian....ret..[/64-bit]....[32-bit]..//jmp dllname.functionname..//or manual:..//parameters: (32-bit)..push ebp..mov ebp,esp..//[ebp+8]=input..//example:..mov eax,[ebp+8] //place the address that contains the bytes into eax..mov a

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14247
                                                                                                                                                                                                                                            Entropy (8bit):4.757455540825877
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:p1mEfPL5ThWRM8vLdyWR1hHS+6stplX7ZbaFYBY6tnGb:VfPjylLNkKW6tE
                                                                                                                                                                                                                                            MD5:26C0E56ABEBFB550A9D208D6191816E0
                                                                                                                                                                                                                                            SHA1:8F2392846633AC48A0168AFE9F20AFC124699F4C
                                                                                                                                                                                                                                            SHA-256:A825F660DF2E6C13DBECE0A0F8DC306129BD784F8DC4EFC37E67E9CDD00CE65F
                                                                                                                                                                                                                                            SHA-512:4FC8A18E2F24374953694CB9230D9DDBA7A1B69B3BA5574AE143CB79B8D0F7CD94E9DD7337EC58EA40769A4B552A583C466781AC7EFF50C9199EAB39AD2076A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'CeShare.po')..end....ceshare={}....function ceshare.getInternet().. if ceshare.internet==nil then.. ceshare.internet=getInternet('ceshare').. end.. return ceshare.internet..end....local pathsep..if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep=[[/]]..end....ceshare.version=-1..ceshare.path=getAutoRunPath()..'ceshare'..pathsep..ceshare.formpath=ceshare.path..pathsep..'forms'..pathsep..ceshare.imagepath=ceshare.path..pathsep..'images'..pathsep....if package.loaded.xmlSimple==nil then.. package.path=package.path..';'..getAutoRunPath()..'xml'..pathsep..'?.lua'..else.. package.loaded.xmlSimple=nil..end..ceshare.xmlParser = require("xmlSimple").newParser()......package.path=package.path..';'..ceshare.path..[[?.lua]]....function loadCEShare().. ceshare.settings=getSettings('ceshare').. ceshare.secondaryIdentifierCode=getSettings('ceshare\\secondaryIdentifierCode').... require("ceshare_account

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_account.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6583
                                                                                                                                                                                                                                            Entropy (8bit):4.856845566130843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:2m3dOvyXANbHC7jmHmQr2LHymHG21h5rSTW/S4XHhOLOxInDLnrTH2n8ruHqhV4Z:2m3UvyW9mL/N5XYFCoKmo
                                                                                                                                                                                                                                            MD5:0B5180BD64689788EBEAA8E705A264AC
                                                                                                                                                                                                                                            SHA1:43A5CC401EE6C4FF4A94697112B1BC1D4345FC19
                                                                                                                                                                                                                                            SHA-256:8FD38A5E6C0408CA77E0E7A0EE179B4391758EC6DA94EA289E3A2CBC1AB1EC59
                                                                                                                                                                                                                                            SHA-512:CC26E2E36B93BF89AA16C744B2DB60D855DE616DB7A67F4FB24135545104459338C3EDEAB42BB316B1ECB0DB9E31970B1415A1BF638EA3E53AE31471330AEADB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..function ceshare.login(username,password).. local i=ceshare.getInternet().. local parameters='';.. if username then.. parameters=parameters..'username='..ceshare.url_encode(username).. end .. .. if password then.. parameters=parameters..'&password='..ceshare.url_encode(password).. end.. .. local r=i.postURL(ceshare.base..'login.php',parameters).. if r then.. if (r:sub(1,2)=='<?') then.. local s=ceshare.xmlParser:ParseXmlText(r).. if s then.. if s.Valid then.. ceshare.LoggedIn=true.. return true .. else.. if s.error then.. ceshare.showError(s.error:value()).. end.. end.. else.. ceshare.showError(r).. end.. else.. ceshare.showError(r);.. end.. else.. ceshare.showError('Login system failure').. end..end....function ceshare.logout().. local i=ceshare.getInternet().. local parameters='';.. i.postURL(ceshare.base..'logout.php',parameters).. ceshare.Lo

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_comments.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4018
                                                                                                                                                                                                                                            Entropy (8bit):4.735117902416751
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:5ASgbBrZUxqShyY92Tm1E+J7YYI0+9+DKeRA453wxQRBhqvr5OOeCYBhSj:5ARB2hhPE+WY9+AzE5XsBhSj
                                                                                                                                                                                                                                            MD5:0D4D1B597712015EF1B0EC8ADC26495F
                                                                                                                                                                                                                                            SHA1:3584779C06619F545B47A27703AA2F47455D50DE
                                                                                                                                                                                                                                            SHA-256:89C8FCCC16D2AA0A3004DC1B477A5C1DCBBA539769B2A4558F7C7D9B9809B133
                                                                                                                                                                                                                                            SHA-512:AE26BBB2C3F74C143A01EC3B296A26699C679D51BC68C8C7B8C460616D1A0AA065500EBCA83E972A720BD7A3C5A7B63A673EAECEF1391A2E717208EF8DA0796F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:function ceshare.QueryTableComments(entry, startindex).. local result=nil.. local parameters='id='..entry.ID.. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryTableComments.php', parameters).. if s then.. if s.Comments then.. result={}.. .. for i=1, s.Comments:numChildren() do.. local comment=s.Comments:children()[i].. local entry={}.. entry.ID=tonumber(comment["@ID"]).. entry.Username=comment["@username"].. entry.Message=comment["@message"].. entry.Time=comment["@time"].. table.insert(result, entry).. end .. end.. end .. return result..end......function ceshare.createCommentPanel(comment).. local panel=createPanel(ceshare.CommentsFrm.MessageBox).. panel.Align='alTop' .. panel.Tag=comment.ID .. .. local pnlMessage=createPanel(panel).. pnlMessage.align='alClient'.. .. local lblUsername=createLabel(pnlMessage).. lblUsername.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_fulltablelist.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12865
                                                                                                                                                                                                                                            Entropy (8bit):4.882563186282491
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:08NVYz/SCrsKrYrygrL5UHsCYBv2S5OVhxPSidLhHYWZHHYzHuxN5FoXQuHNVcbU:Xod1grbuz9hHYWJaQCHqC
                                                                                                                                                                                                                                            MD5:665BB2E55E2A13157D1DBFEF05D1B905
                                                                                                                                                                                                                                            SHA1:408FEA33F574BD0FA9E4CB71958363398E0699BC
                                                                                                                                                                                                                                            SHA-256:DA6ECCE3DB7D305813FFE80CA994663D43F1068F0FB67399A4C66D1F28684BFA
                                                                                                                                                                                                                                            SHA-512:8FE95E22680E1E802D0CEEECBBD6B098526468B8CF4D838301D2833247D94E4F3B3A4B76A68F9FAAA2177B42FF2FFEA2DF46EF56A4A0CE501D126135CE8EE985
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local DPIMultiplier=(getScreenDPI()/96)..local ThumbnailWidth=240*DPIMultiplier..local ThumbnailHeight=80*DPIMultiplier....local DummyBitmap=createBitmap()..DummyBitmap.Canvas.Font.Size=12....local getListItemData,getThumbnail,generateListItemBitmap,getListItemBitmap..local cleanPage, setPage,getFullProcessList,filterList....--[[..ceshare.FullProcessList is the downloaded list which contains all entries..ceshare.FullProcessListView is the searchresult....--]]....local backgroundcolor....local darkMode=1..local windowColor,listColor,searchFieldColor,fontColor, fontSize, linkColor, highlightColor..if darkMode==1 then.. listColor=clBlack.. searchFieldColor=clBlack.. fontColor=clWhite.. windowColor=clBlack.. linkColor=0x0000ff.. highlightColor=0x00ff00..else .. listColor=clDefault.. searchFieldColor=clDefault.. fontColor=clDefault.. windowColor=clDefault.. linkColor=0xff0000.. highlightColor=clDefault..end....fontSize=12........function getListItemData(index).. local width..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_permissions.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3720
                                                                                                                                                                                                                                            Entropy (8bit):4.600809001198686
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:5JPi+sMwj8PiwwVtZw/FHesmsd6e2g8Qp18RHB0vjjmmNDARNbMymMNPuZdMUX28:5J6+sd4aw2ze/bPWh0RNaoy5uUY2hrEF
                                                                                                                                                                                                                                            MD5:65C8D4EDDFE05267A72EAE3DDB2CF02A
                                                                                                                                                                                                                                            SHA1:EEF2928D355C8B669F8854DA37162BA1FE32740A
                                                                                                                                                                                                                                            SHA-256:15B0C7682E5E8D2E2C2B8CB00C0C03B7DFA9439AC80C37F8E96A4F86652246F9
                                                                                                                                                                                                                                            SHA-512:1C151D5A44482362430FBC6ED4550671AD96E768942E4EC2A4C487182BED9D0326A0D40A1AC43F2C8A3DE1E18E33B055CE7126D80FEE9B5B7091ED83A22A41AD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Responsible for editing permissions on tables and changing the owner....function ceshare.ManageAccessList(entry).. if entry then.. .. if ceshare.Permissions==nil then.. local f=createFormFromFile(ceshare.formpath..'Permissions.FRM') .. ceshare.PermissionsFrm=f.. .. f.OnDestroy=function(s).. ceshare.settings.Value['PermissionsFrm.x']=s.left.. ceshare.settings.Value['PermissionsFrm.y']=s.top.. end.. .. f.lbUserNames.Width=f.canvas.getTextWidth('this is a very long username wtf').. f.lbUserNames.Height=f.canvas.getTextHeight('QWERTYjkl')*10.. .. f.lbUsernames.OnDblClick=function(s).. if s.ItemIndex~=-1 then.. s.Items.delete(s.ItemIndex).. end .. end.. .. f.btnAddUSer.OnClick=function(s).. local name=f.EdtUsername.Text.. if name~='' then.. f.lbUserNames.Items.add(name) .. end.. end.. .... local newx=ceshare.settings.Valu

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_processlistextention.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10057
                                                                                                                                                                                                                                            Entropy (8bit):4.490014854752693
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:ejQ2511mA/SZ1aHe768NxSnLuYd42QRDwdmxst8mHWVZyjqb/9rPj4Y8JYs5Rjkc:eH7eeeBJZhbN0X1R
                                                                                                                                                                                                                                            MD5:607A7C1AB93026D94916F21779D0D645
                                                                                                                                                                                                                                            SHA1:3D5A64B256FC44086E6E190EA0BC45B5999E1979
                                                                                                                                                                                                                                            SHA-256:EA61EEA6289C2FEBA7B7D0CC24DB5277E383102F24784E6BF7254AF41829599C
                                                                                                                                                                                                                                            SHA-512:D6749E2DBE46466A1CB1C464CE3F237836EF6B572EF897C7F5C9D12F80A6C0C7A5DFEA54C3499A91E14B29C8BBF0809CCE433C379F9E5DC0072E436F641C59AD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..function ceshare.GetCurrentProcessList().. ceshare.currentprocesslist={}.. .. for pid,name in pairs(getProcessList()) do.. local md5name=stringToMD5String(string.lower(name)).. --search processlist for this.. if ceshare.processlist and ceshare.processlist[md5name] then.. local e={}.. e.pid=pid.. e.name=name.. e.md5=md5name.. table.insert(ceshare.currentprocesslist,e).. end.. end.. .. return ceshare.currentprocesslist..end....function ceshare.DownloadProcessList().. --Downloads the processlist .. local i=ceshare.getInternet().. local processlist=i.getURL(ceshare.base..'processlist.txt').. .. if processlist==nil then.. return.. end.. .. if processlist:sub(1,1)=='<' then.. return --it returned html code instead of a md5 list.. end.. .. local f=io.open(ceshare.path..[[processlist.txt]],'wb').. if f then.. f:write(processlist).. f:close().... synchronize(function() ceshare.settings.Value.LastProcessListDownload=os.time(

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_publish.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21455
                                                                                                                                                                                                                                            Entropy (8bit):4.719034004905997
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:K3KK7BDUUhaWlvyDep8IcDsfUPrBUpJRg:K3hDUUh3Kqp8X9UpPg
                                                                                                                                                                                                                                            MD5:87CD08B16891E0DBE3D47BB71CA91691
                                                                                                                                                                                                                                            SHA1:55D98338B4AA0DF3566CD2E721B3D3F86A3836AA
                                                                                                                                                                                                                                            SHA-256:6BFD35AA64AB566DDB68D0675AD3B4A093649010A9C30DF3A30A7F9DC2ED7702
                                                                                                                                                                                                                                            SHA-512:847BECF1D3066A3E185001035B68496B91876BDEB323734782C41FC9B2BDF665BF33C728CEBBE78E820654D87B1969C09B5D1FAED7498538CB5F761984108614
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local function isWindowVisible(winhandle).. return executeCodeLocal('IsWindowVisible',winhandle)~=0..end....local function getBaseParentFromWindowHandle(winhandle).. local i=0.. local last=winhandle.... while winhandle and (winhandle~=0) and (i<10000) do.. last=winhandle.. winhandle=getWindow(winhandle, GW_HWNDOWNER).. i=i+1.. end;.... return last..end....function ceshare.getProcessTitle(pid).. local w=getWindow(getForegroundWindow(), GW_HWNDFIRST).... local bases={}.... while w and (w~=0) do.. if getWindowProcessID(w)==pid then.. if isWindowVisible(w) then.. local h=getBaseParentFromWindowHandle(w).. local c=getWindowCaption(h).. if isWindowVisible(h) and (c~='') then.. bases[h]=c.. end.. end.. end.. w=getWindow(w,GW_HWNDNEXT).. end...... for h,n in pairs(bases) do.. return n --just hope for the best..... end..end....function ceshare.getCurrentProcessTitle().. return ceshare.getProcessTitle(getOpenedProce

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_querycheats.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25075
                                                                                                                                                                                                                                            Entropy (8bit):4.523124761905836
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:RYDUUhQNWv2rzc3lytSv5ooI0/r5cCAn9zZMf4gybrby15VZ3faxLao0iH+WpeCC:uDUUhQ0OrbBKGYU63
                                                                                                                                                                                                                                            MD5:623B89F1E13C54A1F560B254317948B5
                                                                                                                                                                                                                                            SHA1:B90E2DE7A5CFF0B14738F2FB4F6A3A4E1EE1A17C
                                                                                                                                                                                                                                            SHA-256:0C6E90C2525F1560ACEA3F4BDAE056D11DF1C2F675C2335594DC80BB910A1B17
                                                                                                                                                                                                                                            SHA-512:F80CD50F860A5F8D5C6D6AB7BA8691B443DA91573F3F0FC8D5B82B79556C5AC02ACCC610870EA61A886ECB8A4491457965D082F8F41DF781DED1DB84F7157A3F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:function ceshare.enumModules2().. local m=enumModules().. local r={}.. .. for i=1,#m do.. r[m[i].Name:lower()]=m[i].. end.. .. return r..end....function ceshare.QueryProcessCheats(processname, headermd5, updatableOnly).. local modulelist=ceshare.enumModules2().. local result=nil.. local parameters='processname='..ceshare.url_encode(processname).. .. if isKeyPressed(VK_CONTROL)==false then --control lets you get a new script if needed.. local secondaryIdentifierCode=ceshare.secondaryIdentifierCode.Value[processname:lower()].. if secondaryIdentifierCode and secondaryIdentifierCode~='' then.. local value,param=loadstring(secondaryIdentifierCode)().. if value and param then.. parameters=parameters..'&secondaryidentifier='..ceshare.url_encode(param).. end.. end.. end.. .. if updatableOnly then.. parameters=parameters..'&updatableOnly=1';.. end.... .. .. .. --local r=ceshare.getInternet().postURL(url,parameters).. --local s=ceshare

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_requests.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5622
                                                                                                                                                                                                                                            Entropy (8bit):4.880391114169657
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:5cHxYq8COheJHVFvNmAYVL9rAaDu+WYtUX8T794B:5cLJHVF0AGBli+LtcYSB
                                                                                                                                                                                                                                            MD5:6CF99831E2AAAFB97E975EAE06A705FF
                                                                                                                                                                                                                                            SHA1:B6E71F7D3C779575598B65A6E4FB341344A3DDD2
                                                                                                                                                                                                                                            SHA-256:E9D57ACB17502AC169DEB37F211E472F68CD6E8A69E071D384B989FA45E9FA7F
                                                                                                                                                                                                                                            SHA-512:F6467C4C9DCAB563DBB5A337C76616208D1A1058D704B222E616E5A0809A156B1A29198919F4BF0D40C55A6E972439722C02AAC8A156C53572B6D7EF80986405
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:function ceshare.QueryProcessRequests(processname, startindex).. local result=nil.. if processname==nil or processname=='' then return end.. .. local parameters='processname='..ceshare.url_encode(processname).. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryProcessRequests.php', parameters).. if s then.. if s.RequestList then.. result={}.. .. for i=1, s.RequestList:numChildren() do.. local request=s.RequestList:children()[i].. local entry={}.. entry.ID=tonumber(request["@ID"]).. entry.Username=request["@username"].. entry.Message=request["@message"].. entry.Score=tonumber(request["@score"]).. entry.Time=request["@time"].. .. table.insert(result, entry).. end .. end.. end.. .. return result..end....function ceshare.createRequestPanel(request).. local panel=createPanel(ceshare.RequestsFrm.MessageBox).. panel.Align='al

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\BrowseCheats.FRM (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (8956), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9023
                                                                                                                                                                                                                                            Entropy (8bit):6.421978633663277
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:bmmNyxgIf4EwW+rLEUeD0qdYKjj4vxs78t+ojoFv3VU:bmniIf4ERWrPM+O8zjoFv3VU
                                                                                                                                                                                                                                            MD5:D4F5FE5A2F5FEEB3D97B2FDF4AE7E6BC
                                                                                                                                                                                                                                            SHA1:EEF59C5A8AACD86F993E2BB3F8E5892817A9F7EB
                                                                                                                                                                                                                                            SHA-256:9CB25C63AB41BE2BA3984DF20686DD27BF937E029EBFAA56EBE88BAC6DFC53B6
                                                                                                                                                                                                                                            SHA-512:B00E9467A5203B04A958A69B20152AD5907E5337A43E3FF8F9209A01D7874DD477BB8596E93B3ACAF7354EE7CE76E742F4A72F598473A9C8CC36BBDBB240BB43
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareCheatBrowser Class="TCEForm" Encoding="Ascii85">wR#CWlw0]!JBwM2C0mxHv1BJor9!e#+^)IR4PFdmhMBQtR{#urq9RgV#kEvaQcTH}rPWf1D1?=9ma[cDQq/,%]{:,V_93t!=;px[:Q,;vJ/mDkeU6R/0GJu.C=L%:wROl8(-E?8Pfcx8H#]N?bOZ4.4GP)h3R2,upbHJ:14Zb81Xnj23:4(sk-cDF047U/GtCXA4##MaDb64T:R[t@F*WS+)+P/B@fUlTJ@*e@==oe!NeI;jme=hpESf_DNTU7Zh+_vqgCT%oh-8c;fkf2OU2#DQDDXpwtH8Vv({A8z[7MrLBqS4[$S7yl0DVECkq-?_AQ6tfhGY];YmZlf-,Dxu.T=[Um4E@Zo$KQr7dl[KE3V(1a(jY6ObO25ycqJDWD/:,CL)]I$Foep:;G5Zi[+iEq:#aE5k3LnTr^Am7v70La,O}s^%JZEV,z;]q+6)EPjENJnBg80O[NL^Q(1}pWg_Kgm+?-]bpIgnqDox95zIdz)ReCFgG^55J:a!fvH2n;(H$?w1SS5nLd@aPmpteX^-zFQUL69JW/db]P)/Ga%uxSTmwywM@Vj.^ROMZ,HJR7t?80A7o#HnRe9QHV1@*/.C6eEG^E86R?kM-Nmms1FM:mm.VwmtAj2Z.qW4-_r?39}e3h%MVhB4sCL=2HQl=^U0:R,f#5*OmtpN3}LBhZN8l9LR9*kqMGB1S).G:$Y?jC}x51g9k$hgE5qOr6M-A6+=/m4wRzq*-[TSOUoz@a2=[B-*a]0A%%!O(MbxbY9{;zA6oJGu8l4b8:fE3R#s1u1[F(EKwW*0JJWJ.LIojsc2R]hF=rUBIq/vh)a5ay=ngpLm3j]/v9.clnID.HX.!N({b8}-y$V=MfgC@W7m]xKm=H{U#bb^MW*aIU@

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\CommentsOrRequests.FRM (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1145), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1212
                                                                                                                                                                                                                                            Entropy (8bit):6.394471687276162
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dqQ7rMmbWa4nYCr0eZK8kNIkhXKLBq0IykSiHqVMywpvh:cqQ8ha4v0eZ9kexM+kP6Svh
                                                                                                                                                                                                                                            MD5:CD4D7AEE15163AB407B4F18D8F93DCC3
                                                                                                                                                                                                                                            SHA1:676E3EEA53646F221DCB4C9B7DCC2CB5315F36BC
                                                                                                                                                                                                                                            SHA-256:D8DE8120C14DA094FEDDB24C46C3E729D99696CCCE9C2D479797FFBBF34BD20B
                                                                                                                                                                                                                                            SHA-512:17EDE3DB62A9D2ABFB8D2715E5ED816A7BADF1EB7EAD79E5B48AB6DB7DCD8215B40CDD03D4A3CFD5EDE4567FA5092D9F7406FB25BC82DCAA26CBEA57C2207F69
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_frmComments Class="TCEForm" Encoding="Ascii85">t)DDk,cpr#A/7c=p(aVCac_YJC*M=gGd/*Y)eX$#io:=Udus-wRuV:apn#yqb]QPxJ@Bc{[m*dvqKCdmL4qHm#,r26oJcGdi}s)10sLwsGz,fI?XUXGC1m[Of?Do3ykE-L7jX/,B{Y=Os]l9Gj*AV$s^Osyo^4Sy-s:2F7i!(p*p/6I6ukpqa3ux9cKimCgsi_D3Aq3^i3Cr*-kgRHi2@.zQ-po8RaEfqNx4m5$i9RRDI[ZC]HX5=wV]Lm*qa/d(:sH27:mEZ^sXyFe_ift$pYf?!P)(D.0)F5Fw%0@NZh-HApM)XW1%vckF6^j3st$Cj*i/I77^s[?JK=Y(uSevX96A1YMnHVVJw7NJ1=5nnIzGM?_AO^MXINRH*o3AO:A)fGh^k;Y!havbbP@t#7?L6VM$V@yg+lwtK4kcGctdhRl!0C+{BXD.lO%Dt?1$:iN+5r^?JRK*Ekb3QX,Ooa0l#dszBoI^O)$CXcWw1d-bX^v^2S+Zy++]le]%6Xf0$(7m):}lwH*2[,^.,#Z@8Io3m?USLYYUO@57?9g._,[[UtA$rM%r?Lcf[[}NVD!L0bCjKXbiBZJZ_QNGHX;zjh*Z%5dyPrMG/:$S6rWd4_Ja#c3jm=-Gj9Gq{VBHcCv6ZDIwF@g/JZ]$%OmVMH,nxNKhE7(2hP!Xxi=(#ks?ReGZ9Wo[zV9zw#K+AjrX;xvXfPVwdLCAHLx[(AX-K$/C$Am8eLAf(5%TGrov.OXZw0[:0R/c4+XI?/@Ua7r+e(JqeAp;)t,:z^Znr7a^9I6Kfp0]ZiaUG6P4ybW^Tr/dg=HxRIPX7x^!_P//Yp:Nu*BEcHz3?NM!(z#dmz/-=jZ(QkFVEb,0e9$F]#Lbl(x6$/^Jlc;ZI1Bk0@u*+5Zc33

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\InitialSetup.FRM (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1222), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1289
                                                                                                                                                                                                                                            Entropy (8bit):6.4066800193563065
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dIQ7TXr3F7R/8TDt3E/IlGZ264FeZqE1OieF5MiVM6wJAHWMzX4i0pdp:cIQHr35MMIlGZ264FzIjQ5jS2TSpdp
                                                                                                                                                                                                                                            MD5:23CC858DA49A7BDA9E9FE3ABF8D86D1D
                                                                                                                                                                                                                                            SHA1:9D869496104ACFFF0C5CB572628085666DC53486
                                                                                                                                                                                                                                            SHA-256:D5786540891C411BC34A5505A6CEE0E747DF2E5CD410ABFEB94E6D4169C85069
                                                                                                                                                                                                                                            SHA-512:B5650AB1AE463F97F5681DD3FDFF7015C963703A7437AC5F71A158F3E0BDC045E69151897D0EC75AA9DD4CCAC5475E6E492CE46A296BCAB8C4C329720E3C002A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_InitialSetup Class="TCEForm" Encoding="Ascii85">wN:e-,eQ$kD9Ms,:TOJVp^GGFDT-EToc7S1YS9iF+scsqg?Im+B^;qeS=.pCOS_er@cngXeS_z#W_tHdx*PcO:s@)oZ_3^H]F8g0FbL,=uf874qw]lv:f=={jA^Jkwd9sFF,+Dxy-Qr!=$6:g56G99=M@z}xhlH-PXCstHtT-YAD*)0(G.WU8bqwHT+/vB)fQ0pf.tlTP:{G:C}Xtypc:2@1Vh4c$zl{4]v1949uDi:A-L2b*R^l,[fG_1%0ZtAnm=K-ouZx/Ea7rFu1,=Ho}^ukD$h$owSu2,E=+v8*10*C5:xUA_3GlE6,!SZ2.@i1lnOPi0fRLjLIEpP!aWxPVgwco1goGdgkmW$nL=]Wr5^8YG7EFJ#lS,VoZ^3q1B3bw@?d*H,3:Q--D+}hws3sW:Ggr!?FcU3AbI#[CkW2CNd*6L;X$Ij(:4oWXEUzTuL]C}]3kEUyXBQ%mC6FK#1xc/oN.OCN27Q{2eBr8E_*Y3g.u^{V!!m-NCo#yYbGfy9o1,GB?K@-tFXo.*2Y+(f@a7e:]SsC1518}atv@G6]exl.2Mxf8A/xssVV*ZOU==*SZK}HeWy8;,+r+lWm5}kp[cwWQ%w}$vLy4RtQiO^-vF2XJ66[G=X+*HoFXm_Rnn8R^uH6qt4I5f[OAspgC03ctUvBJ5]QAF(g[*aupmT;QqvYqnSLv_:4i$^eQ-cNh+Tb^iTeF8iEBTS9UoZ!bMJ:lYd0KyfEymSCvSY1.r=rj]T80S$.4B*DGVw^UNh,);HnWUJ)WqO@o+zILXIP%uay__r.h342dnO5Fk)hW^)e2#EEB?!Y-9JM[Ih*A.;%L=yKmS1E/Ew:=r]1i^th/n=vpl8CsXgZJy+pHd.1f-LoqE0-e51j]%y]3b.Iz

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\Permissions.FRM (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1189), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1256
                                                                                                                                                                                                                                            Entropy (8bit):6.4186272262096935
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2ddlQ7Be7XyJpQUDdX+ZdEjY6JFxhiVFtGgtkyO3FwBod6cGcNNnpvrAJX:c3QMOJpQUd+Zq1FnsPtKW2RNNnpMh
                                                                                                                                                                                                                                            MD5:7FFD1E1B425636CFA08CDA89429C69A6
                                                                                                                                                                                                                                            SHA1:EC6A75FCA2BC4F2E8CB7AB9644D1BEDB1D686221
                                                                                                                                                                                                                                            SHA-256:44E9BC08A3F919DA8689C4703E77324568F3902E95F8F3F92CCF234BCF7BF649
                                                                                                                                                                                                                                            SHA-512:DBA72B7A8F1A3D72101E4F735E0CEA1BE8E72236A81E6FC2CE18E7F93715B5C1F21AA384790C7E0097A23AEB6D52E954CE7C7ADF7C6189A855DCD6FADADE7C9B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_permissions Class="TCEForm" Encoding="Ascii85">y[U.z):Zf/9oey,ro#-q)5,Vt!!R9S$+xJ8X]!W:I*x=3[Gx3HNEut^g*J_?8=a(32Vu,0?Bqk]uNgV+l+:lPk0t(8cXV]gv#M#M.o!M7;hBF$G,p.09@)i.%pjVEaU3!l8.5Yl@]E-A58=Tk;z_N5Vl){FtNlI/[+gfPy**.]4L=Jt,hb7x)Sa_/byvO6y@c9dkATj#EadWQ0,#K=Zb.9=Qy/T]SjAjBoduYKGb_Tg=UN8FFP81f_HZ097Kh1L;%ok/egr]KA]FqXBHSE=G4HXfF7Zxdh$x.y^Ah;zV-}q#0EwmTKBGKh#A,X3QiwLosIXTAS3FL4f+[e;t@P(wYjtoO@%(:DnqoqBPU(mQ+bgZ.H,R_GBjA)JpE#U35lq/yNP:2M?K/XsgEPavz[Kl.dRTuch9G0T^[Z4M3*w3Ng0fr}X%B]Xft0(rc9_%!=fj]?kFa-}3]d%#B]MzvLf)ad:ZKmJRVg-bvc*th$K^l@%4n*x#ko!rJxO4pi.UG{%aT+X-8P/xh;0i3[ZFU^6KV:-wvw7r.%M0{5SQaf.OmITL!jq.jI?U%xZ)-Afl%3JghiI,lODnTq!yB!,B{PUj0Bq25omjJVV721^UdJG*NCw%q{rnTmsU;pX[YLxUI1GVEz4WQwy0oR7/J{COUYI2Gdrn8;.bWfM-FyJSNvXOD1(lm7]c8Y*o+0[w@T*BsEVkNj1G3YvRcyQ,7-F(RPK[3AgLnZXMN$D1=WwA(v8gkCu(bGlm_nhUy5w9kcb=GoWK)3g@b%_-sSLHNX,BR#I[.[sPvFZZ1P}_9^yb;s,g3=$bIZDPevhiSw3;9[s,+^$AxTx%6z:ed/;T7Bb_Q1L+6Wk/@NAQ^:Apm:{0USE[:-(;oqsG@%}]dD33q:

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\PublishCheat.FRM (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (2354), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2421
                                                                                                                                                                                                                                            Entropy (8bit):6.429603749104613
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:cFQ46+MhmKUEJ4Luu8nEq61PwmKekYxRfEQWtJSmhfQl:M0hm9o41bpPRkoEfScIl
                                                                                                                                                                                                                                            MD5:D6FCB383A27920083054DD42003BEC4D
                                                                                                                                                                                                                                            SHA1:3941A986929680D50B8B74E61323D1D6C20AEC27
                                                                                                                                                                                                                                            SHA-256:A8611471651393E17090167C5B6CADE46EAE9FEE8841DB0816BF36A4F43FBE16
                                                                                                                                                                                                                                            SHA-512:405CBB3823344BC321E135C8084710352506A342FF22A2C356B0629EB6E929AC44C0098BD6E90256BC0814A7693D367E6E4AEA8BF277B122654E19A185D52938
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCESharePublishCheat Class="TCEForm" Encoding="Ascii85">y.*6f8${pi=/W3.*1,zArU6k,d!d!ufQl-ls,Y!fNFZO-X-g#{G,vLhtBhx=-Ekaq/H#SVsCq+c68]]WTsU(!!kr5zeg+IBtoO@iYsXEHBFEnOc.Dxp:Xq!Lokuq]=eJjp/I-WRzR8]:wYJl#*f+Oe$U)13ZP%)/1dEv,)iX:3LUD]ON0u/Ex@c,6#@2iP3%eyO.{5/3xF;kS^,3j#8^BCTXWQh:t/E;=#:sS%vrAY^E7fpU+qjxY^K=TC:[Aj:e2v/KiD3S!]aPUpD{#eOxJl;(ZPEjWo5XeZaEDxb%uI[r4ZB68kLxwggu]iRcE8Vvb2V%Qe{l#a)h]w5uEcxE_D[6cof/em91pub/3raMC35_y0/LdgQD[?oY{*K-UG*uc(ihsvSb11IfT%K2/CHsPO[L$tB@@HBc_u(%vAq#laLPXVPcje%=O9khxDdRv8n!-[XcFOCNj4^jUk{@WgJ66SR@^2#op]K[rGiJ3ABHsfT]#E[-0CbohNdDumLp2_+t1v0$7*[{IUZK8RiC+E:3L:mn,bP*+Jl2b,[/!3Gvcl^gae*3Lh+7WqR1i,)dHT@xJfs#/Cco93s$W1A#UzVBS5YOp$(l?p/k*M+B!!,U}M%mWL+(7oCP_-jL-,!3#8if7buNv#]k^w@hW]*su6=/UP,%lQ+(KLH,nEDbMsZQoM:r5APbS%@i+u-Bg+E=h)!JNw2(Crhq+@z@J4OE!ROQ*E#Q;TrjSKpQd*{hNlLi95]U)}:.gT$azf}S50ICN(67RONGv)(Yq8w*Mhl5l(=+po74x}KV1Aa%ihg8*GGZL+p[rk=qM#3n?kNL/ph)HLzLF5la70LdE#h[s,@%6{5{N6C2rQF0DwdOiIv5KoEz8apm7gJE_G],m1w

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\UpdateOrNew.FRM (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):936
                                                                                                                                                                                                                                            Entropy (8bit):6.410328130247008
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2d3Q7M2RqjiEC8Fpohhnh13sAy/jtaos59:c3QAkqeP0poh1b3Ivs
                                                                                                                                                                                                                                            MD5:5AD30685C039C115C346D24223C3EAE4
                                                                                                                                                                                                                                            SHA1:814C5B02040E87906E7A64F4355B8A35101BDACF
                                                                                                                                                                                                                                            SHA-256:BD3E07DECC17007796403191246AB0F3585F51532FBF16D496E541C3107D7E0E
                                                                                                                                                                                                                                            SHA-512:DE29C279573C7CC542E8A9AC427594E067D47DE390A7D41AC2E7CCDDD646550B5ED6D2ECAE39B2C7B798649B6D61BA5BD259FD0A8814D35B508D3AE96DD19BC1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareUpdateOrNew Class="TCEForm" Encoding="Ascii85">os;.-):Zgr6,4OTNt(59EwId?!-7TO0xTN0rObpT#G!1F=Uz]?kvx+pOgRb+ZopkQ0?q-NY(l9{LORopKlDEI-tYaTk4:OoqpLU0#J^^@d}q]63.!{mFo#cBj3o@D4Xo,_m]eM:Ze9bKCDQ(=vnMRGzt/X^Nh{ll)r*z]kAc6B7!_E^NP;GIVetXz5..E3Bw?7K)HUQ7%P:J)Y5OSwDox6k^$FQwM?+1B(go//h(TZCl@Hl^sagj[$Xfy^H?**^z+0Orr%{RqKw]+=J?XlroTW{/xT3(MHda-+F{gg_H63l,@S9$,!TU?}ws@j:j]LzG$(ah%O8AS7T]!n.kB1]-qabY6+MM(dz{9KW[pR.d9HQ00b7g7bc@:@4d9kC5:Q:Yw)sKwh91%J?)@/RQi$#c4cYKyE7gTg:=*g%)fP4eb%(IXVG6lW8b%S:fG{V$Ssq]VceTw#=)(x*gpYAPip,0)q#+l${P,9hkYP,*rWJVz[vwlU$d(fyUAQXgmaIG+0kV2HZy6zZoJf!Kp:Z*D*uY2wUhr@tRRr7KY1?b-x$GsC^$QYLhwI@d76V[iUrqqb!NfOh;=eSWt#dJ}G//H$yGwrtZ[C1M1Ri:]AG;7.;6Ub4Yfn:FiseB]@CzbAnlKKf[.+sOAN8cvHE(w*P-ygq])RZorM-+,=9F]6CD6BM}4HruZLtPam3scH_7Tt:}@r_nP_DiIZpNi[ANtE[V0){#_tgS*5DnR}NgZ#4x/mMn9ZX=aL:pJvc:?]p3ppVPTd)B(m?dBoJnLa#GHbUqx</frmCEShareUpdateOrNew>..</FormData>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-5RRLD.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):936
                                                                                                                                                                                                                                            Entropy (8bit):6.410328130247008
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2d3Q7M2RqjiEC8Fpohhnh13sAy/jtaos59:c3QAkqeP0poh1b3Ivs
                                                                                                                                                                                                                                            MD5:5AD30685C039C115C346D24223C3EAE4
                                                                                                                                                                                                                                            SHA1:814C5B02040E87906E7A64F4355B8A35101BDACF
                                                                                                                                                                                                                                            SHA-256:BD3E07DECC17007796403191246AB0F3585F51532FBF16D496E541C3107D7E0E
                                                                                                                                                                                                                                            SHA-512:DE29C279573C7CC542E8A9AC427594E067D47DE390A7D41AC2E7CCDDD646550B5ED6D2ECAE39B2C7B798649B6D61BA5BD259FD0A8814D35B508D3AE96DD19BC1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareUpdateOrNew Class="TCEForm" Encoding="Ascii85">os;.-):Zgr6,4OTNt(59EwId?!-7TO0xTN0rObpT#G!1F=Uz]?kvx+pOgRb+ZopkQ0?q-NY(l9{LORopKlDEI-tYaTk4:OoqpLU0#J^^@d}q]63.!{mFo#cBj3o@D4Xo,_m]eM:Ze9bKCDQ(=vnMRGzt/X^Nh{ll)r*z]kAc6B7!_E^NP;GIVetXz5..E3Bw?7K)HUQ7%P:J)Y5OSwDox6k^$FQwM?+1B(go//h(TZCl@Hl^sagj[$Xfy^H?**^z+0Orr%{RqKw]+=J?XlroTW{/xT3(MHda-+F{gg_H63l,@S9$,!TU?}ws@j:j]LzG$(ah%O8AS7T]!n.kB1]-qabY6+MM(dz{9KW[pR.d9HQ00b7g7bc@:@4d9kC5:Q:Yw)sKwh91%J?)@/RQi$#c4cYKyE7gTg:=*g%)fP4eb%(IXVG6lW8b%S:fG{V$Ssq]VceTw#=)(x*gpYAPip,0)q#+l${P,9hkYP,*rWJVz[vwlU$d(fyUAQXgmaIG+0kV2HZy6zZoJf!Kp:Z*D*uY2wUhr@tRRr7KY1?b-x$GsC^$QYLhwI@d76V[iUrqqb!NfOh;=eSWt#dJ}G//H$yGwrtZ[C1M1Ri:]AG;7.;6Ub4Yfn:FiseB]@CzbAnlKKf[.+sOAN8cvHE(w*P-ygq])RZorM-+,=9F]6CD6BM}4HruZLtPam3scH_7Tt:}@r_nP_DiIZpNi[ANtE[V0){#_tgS*5DnR}NgZ#4x/mMn9ZX=aL:pJvc:?]p3ppVPTd)B(m?dBoJnLa#GHbUqx</frmCEShareUpdateOrNew>..</FormData>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-H6F9C.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (8956), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9023
                                                                                                                                                                                                                                            Entropy (8bit):6.421978633663277
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:bmmNyxgIf4EwW+rLEUeD0qdYKjj4vxs78t+ojoFv3VU:bmniIf4ERWrPM+O8zjoFv3VU
                                                                                                                                                                                                                                            MD5:D4F5FE5A2F5FEEB3D97B2FDF4AE7E6BC
                                                                                                                                                                                                                                            SHA1:EEF59C5A8AACD86F993E2BB3F8E5892817A9F7EB
                                                                                                                                                                                                                                            SHA-256:9CB25C63AB41BE2BA3984DF20686DD27BF937E029EBFAA56EBE88BAC6DFC53B6
                                                                                                                                                                                                                                            SHA-512:B00E9467A5203B04A958A69B20152AD5907E5337A43E3FF8F9209A01D7874DD477BB8596E93B3ACAF7354EE7CE76E742F4A72F598473A9C8CC36BBDBB240BB43
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareCheatBrowser Class="TCEForm" Encoding="Ascii85">wR#CWlw0]!JBwM2C0mxHv1BJor9!e#+^)IR4PFdmhMBQtR{#urq9RgV#kEvaQcTH}rPWf1D1?=9ma[cDQq/,%]{:,V_93t!=;px[:Q,;vJ/mDkeU6R/0GJu.C=L%:wROl8(-E?8Pfcx8H#]N?bOZ4.4GP)h3R2,upbHJ:14Zb81Xnj23:4(sk-cDF047U/GtCXA4##MaDb64T:R[t@F*WS+)+P/B@fUlTJ@*e@==oe!NeI;jme=hpESf_DNTU7Zh+_vqgCT%oh-8c;fkf2OU2#DQDDXpwtH8Vv({A8z[7MrLBqS4[$S7yl0DVECkq-?_AQ6tfhGY];YmZlf-,Dxu.T=[Um4E@Zo$KQr7dl[KE3V(1a(jY6ObO25ycqJDWD/:,CL)]I$Foep:;G5Zi[+iEq:#aE5k3LnTr^Am7v70La,O}s^%JZEV,z;]q+6)EPjENJnBg80O[NL^Q(1}pWg_Kgm+?-]bpIgnqDox95zIdz)ReCFgG^55J:a!fvH2n;(H$?w1SS5nLd@aPmpteX^-zFQUL69JW/db]P)/Ga%uxSTmwywM@Vj.^ROMZ,HJR7t?80A7o#HnRe9QHV1@*/.C6eEG^E86R?kM-Nmms1FM:mm.VwmtAj2Z.qW4-_r?39}e3h%MVhB4sCL=2HQl=^U0:R,f#5*OmtpN3}LBhZN8l9LR9*kqMGB1S).G:$Y?jC}x51g9k$hgE5qOr6M-A6+=/m4wRzq*-[TSOUoz@a2=[B-*a]0A%%!O(MbxbY9{;zA6oJGu8l4b8:fE3R#s1u1[F(EKwW*0JJWJ.LIojsc2R]hF=rUBIq/vh)a5ay=ngpLm3j]/v9.clnID.HX.!N({b8}-y$V=MfgC@W7m]xKm=H{U#bb^MW*aIU@

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-JS32G.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1189), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1256
                                                                                                                                                                                                                                            Entropy (8bit):6.4186272262096935
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2ddlQ7Be7XyJpQUDdX+ZdEjY6JFxhiVFtGgtkyO3FwBod6cGcNNnpvrAJX:c3QMOJpQUd+Zq1FnsPtKW2RNNnpMh
                                                                                                                                                                                                                                            MD5:7FFD1E1B425636CFA08CDA89429C69A6
                                                                                                                                                                                                                                            SHA1:EC6A75FCA2BC4F2E8CB7AB9644D1BEDB1D686221
                                                                                                                                                                                                                                            SHA-256:44E9BC08A3F919DA8689C4703E77324568F3902E95F8F3F92CCF234BCF7BF649
                                                                                                                                                                                                                                            SHA-512:DBA72B7A8F1A3D72101E4F735E0CEA1BE8E72236A81E6FC2CE18E7F93715B5C1F21AA384790C7E0097A23AEB6D52E954CE7C7ADF7C6189A855DCD6FADADE7C9B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_permissions Class="TCEForm" Encoding="Ascii85">y[U.z):Zf/9oey,ro#-q)5,Vt!!R9S$+xJ8X]!W:I*x=3[Gx3HNEut^g*J_?8=a(32Vu,0?Bqk]uNgV+l+:lPk0t(8cXV]gv#M#M.o!M7;hBF$G,p.09@)i.%pjVEaU3!l8.5Yl@]E-A58=Tk;z_N5Vl){FtNlI/[+gfPy**.]4L=Jt,hb7x)Sa_/byvO6y@c9dkATj#EadWQ0,#K=Zb.9=Qy/T]SjAjBoduYKGb_Tg=UN8FFP81f_HZ097Kh1L;%ok/egr]KA]FqXBHSE=G4HXfF7Zxdh$x.y^Ah;zV-}q#0EwmTKBGKh#A,X3QiwLosIXTAS3FL4f+[e;t@P(wYjtoO@%(:DnqoqBPU(mQ+bgZ.H,R_GBjA)JpE#U35lq/yNP:2M?K/XsgEPavz[Kl.dRTuch9G0T^[Z4M3*w3Ng0fr}X%B]Xft0(rc9_%!=fj]?kFa-}3]d%#B]MzvLf)ad:ZKmJRVg-bvc*th$K^l@%4n*x#ko!rJxO4pi.UG{%aT+X-8P/xh;0i3[ZFU^6KV:-wvw7r.%M0{5SQaf.OmITL!jq.jI?U%xZ)-Afl%3JghiI,lODnTq!yB!,B{PUj0Bq25omjJVV721^UdJG*NCw%q{rnTmsU;pX[YLxUI1GVEz4WQwy0oR7/J{COUYI2Gdrn8;.bWfM-FyJSNvXOD1(lm7]c8Y*o+0[w@T*BsEVkNj1G3YvRcyQ,7-F(RPK[3AgLnZXMN$D1=WwA(v8gkCu(bGlm_nhUy5w9kcb=GoWK)3g@b%_-sSLHNX,BR#I[.[sPvFZZ1P}_9^yb;s,g3=$bIZDPevhiSw3;9[s,+^$AxTx%6z:ed/;T7Bb_Q1L+6Wk/@NAQ^:Apm:{0USE[:-(;oqsG@%}]dD33q:

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-KJ922.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1222), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1289
                                                                                                                                                                                                                                            Entropy (8bit):6.4066800193563065
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dIQ7TXr3F7R/8TDt3E/IlGZ264FeZqE1OieF5MiVM6wJAHWMzX4i0pdp:cIQHr35MMIlGZ264FzIjQ5jS2TSpdp
                                                                                                                                                                                                                                            MD5:23CC858DA49A7BDA9E9FE3ABF8D86D1D
                                                                                                                                                                                                                                            SHA1:9D869496104ACFFF0C5CB572628085666DC53486
                                                                                                                                                                                                                                            SHA-256:D5786540891C411BC34A5505A6CEE0E747DF2E5CD410ABFEB94E6D4169C85069
                                                                                                                                                                                                                                            SHA-512:B5650AB1AE463F97F5681DD3FDFF7015C963703A7437AC5F71A158F3E0BDC045E69151897D0EC75AA9DD4CCAC5475E6E492CE46A296BCAB8C4C329720E3C002A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_InitialSetup Class="TCEForm" Encoding="Ascii85">wN:e-,eQ$kD9Ms,:TOJVp^GGFDT-EToc7S1YS9iF+scsqg?Im+B^;qeS=.pCOS_er@cngXeS_z#W_tHdx*PcO:s@)oZ_3^H]F8g0FbL,=uf874qw]lv:f=={jA^Jkwd9sFF,+Dxy-Qr!=$6:g56G99=M@z}xhlH-PXCstHtT-YAD*)0(G.WU8bqwHT+/vB)fQ0pf.tlTP:{G:C}Xtypc:2@1Vh4c$zl{4]v1949uDi:A-L2b*R^l,[fG_1%0ZtAnm=K-ouZx/Ea7rFu1,=Ho}^ukD$h$owSu2,E=+v8*10*C5:xUA_3GlE6,!SZ2.@i1lnOPi0fRLjLIEpP!aWxPVgwco1goGdgkmW$nL=]Wr5^8YG7EFJ#lS,VoZ^3q1B3bw@?d*H,3:Q--D+}hws3sW:Ggr!?FcU3AbI#[CkW2CNd*6L;X$Ij(:4oWXEUzTuL]C}]3kEUyXBQ%mC6FK#1xc/oN.OCN27Q{2eBr8E_*Y3g.u^{V!!m-NCo#yYbGfy9o1,GB?K@-tFXo.*2Y+(f@a7e:]SsC1518}atv@G6]exl.2Mxf8A/xssVV*ZOU==*SZK}HeWy8;,+r+lWm5}kp[cwWQ%w}$vLy4RtQiO^-vF2XJ66[G=X+*HoFXm_Rnn8R^uH6qt4I5f[OAspgC03ctUvBJ5]QAF(g[*aupmT;QqvYqnSLv_:4i$^eQ-cNh+Tb^iTeF8iEBTS9UoZ!bMJ:lYd0KyfEymSCvSY1.r=rj]T80S$.4B*DGVw^UNh,);HnWUJ)WqO@o+zILXIP%uay__r.h342dnO5Fk)hW^)e2#EEB?!Y-9JM[Ih*A.;%L=yKmS1E/Ew:=r]1i^th/n=vpl8CsXgZJy+pHd.1f-LoqE0-e51j]%y]3b.Iz

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-MN8DU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (2354), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2421
                                                                                                                                                                                                                                            Entropy (8bit):6.429603749104613
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:cFQ46+MhmKUEJ4Luu8nEq61PwmKekYxRfEQWtJSmhfQl:M0hm9o41bpPRkoEfScIl
                                                                                                                                                                                                                                            MD5:D6FCB383A27920083054DD42003BEC4D
                                                                                                                                                                                                                                            SHA1:3941A986929680D50B8B74E61323D1D6C20AEC27
                                                                                                                                                                                                                                            SHA-256:A8611471651393E17090167C5B6CADE46EAE9FEE8841DB0816BF36A4F43FBE16
                                                                                                                                                                                                                                            SHA-512:405CBB3823344BC321E135C8084710352506A342FF22A2C356B0629EB6E929AC44C0098BD6E90256BC0814A7693D367E6E4AEA8BF277B122654E19A185D52938
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCESharePublishCheat Class="TCEForm" Encoding="Ascii85">y.*6f8${pi=/W3.*1,zArU6k,d!d!ufQl-ls,Y!fNFZO-X-g#{G,vLhtBhx=-Ekaq/H#SVsCq+c68]]WTsU(!!kr5zeg+IBtoO@iYsXEHBFEnOc.Dxp:Xq!Lokuq]=eJjp/I-WRzR8]:wYJl#*f+Oe$U)13ZP%)/1dEv,)iX:3LUD]ON0u/Ex@c,6#@2iP3%eyO.{5/3xF;kS^,3j#8^BCTXWQh:t/E;=#:sS%vrAY^E7fpU+qjxY^K=TC:[Aj:e2v/KiD3S!]aPUpD{#eOxJl;(ZPEjWo5XeZaEDxb%uI[r4ZB68kLxwggu]iRcE8Vvb2V%Qe{l#a)h]w5uEcxE_D[6cof/em91pub/3raMC35_y0/LdgQD[?oY{*K-UG*uc(ihsvSb11IfT%K2/CHsPO[L$tB@@HBc_u(%vAq#laLPXVPcje%=O9khxDdRv8n!-[XcFOCNj4^jUk{@WgJ66SR@^2#op]K[rGiJ3ABHsfT]#E[-0CbohNdDumLp2_+t1v0$7*[{IUZK8RiC+E:3L:mn,bP*+Jl2b,[/!3Gvcl^gae*3Lh+7WqR1i,)dHT@xJfs#/Cco93s$W1A#UzVBS5YOp$(l?p/k*M+B!!,U}M%mWL+(7oCP_-jL-,!3#8if7buNv#]k^w@hW]*su6=/UP,%lQ+(KLH,nEDbMsZQoM:r5APbS%@i+u-Bg+E=h)!JNw2(Crhq+@z@J4OE!ROQ*E#Q;TrjSKpQd*{hNlLi95]U)}:.gT$azf}S50ICN(67RONGv)(Yq8w*Mhl5l(=+po74x}KV1Aa%ihg8*GGZL+p[rk=qM#3n?kNL/ph)HLzLF5la70LdE#h[s,@%6{5{N6C2rQF0DwdOiIv5KoEz8apm7gJE_G],m1w

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-NK13K.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1145), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1212
                                                                                                                                                                                                                                            Entropy (8bit):6.394471687276162
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dqQ7rMmbWa4nYCr0eZK8kNIkhXKLBq0IykSiHqVMywpvh:cqQ8ha4v0eZ9kexM+kP6Svh
                                                                                                                                                                                                                                            MD5:CD4D7AEE15163AB407B4F18D8F93DCC3
                                                                                                                                                                                                                                            SHA1:676E3EEA53646F221DCB4C9B7DCC2CB5315F36BC
                                                                                                                                                                                                                                            SHA-256:D8DE8120C14DA094FEDDB24C46C3E729D99696CCCE9C2D479797FFBBF34BD20B
                                                                                                                                                                                                                                            SHA-512:17EDE3DB62A9D2ABFB8D2715E5ED816A7BADF1EB7EAD79E5B48AB6DB7DCD8215B40CDD03D4A3CFD5EDE4567FA5092D9F7406FB25BC82DCAA26CBEA57C2207F69
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_frmComments Class="TCEForm" Encoding="Ascii85">t)DDk,cpr#A/7c=p(aVCac_YJC*M=gGd/*Y)eX$#io:=Udus-wRuV:apn#yqb]QPxJ@Bc{[m*dvqKCdmL4qHm#,r26oJcGdi}s)10sLwsGz,fI?XUXGC1m[Of?Do3ykE-L7jX/,B{Y=Os]l9Gj*AV$s^Osyo^4Sy-s:2F7i!(p*p/6I6ukpqa3ux9cKimCgsi_D3Aq3^i3Cr*-kgRHi2@.zQ-po8RaEfqNx4m5$i9RRDI[ZC]HX5=wV]Lm*qa/d(:sH27:mEZ^sXyFe_ift$pYf?!P)(D.0)F5Fw%0@NZh-HApM)XW1%vckF6^j3st$Cj*i/I77^s[?JK=Y(uSevX96A1YMnHVVJw7NJ1=5nnIzGM?_AO^MXINRH*o3AO:A)fGh^k;Y!havbbP@t#7?L6VM$V@yg+lwtK4kcGctdhRl!0C+{BXD.lO%Dt?1$:iN+5r^?JRK*Ekb3QX,Ooa0l#dszBoI^O)$CXcWw1d-bX^v^2S+Zy++]le]%6Xf0$(7m):}lwH*2[,^.,#Z@8Io3m?USLYYUO@57?9g._,[[UtA$rM%r?Lcf[[}NVD!L0bCjKXbiBZJZ_QNGHX;zjh*Z%5dyPrMG/:$S6rWd4_Ja#c3jm=-Gj9Gq{VBHcCv6ZDIwF@g/JZ]$%OmVMH,nxNKhE7(2hP!Xxi=(#ks?ReGZ9Wo[zV9zw#K+AjrX;xvXfPVwdLCAHLx[(AX-K$/C$Am8eLAf(5%TGrov.OXZw0[:0R/c4+XI?/@Ua7r+e(JqeAp;)t,:z^Znr7a^9I6Kfp0]ZiaUG6P4ybW^Tr/dg=HxRIPX7x^!_P//Yp:Nu*BEcHz3?NM!(z#dmz/-=jZ(QkFVEb,0e9$F]#Lbl(x6$/^Jlc;ZI1Bk0@u*+5Zc33

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\is-0OU20.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 128 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1101
                                                                                                                                                                                                                                            Entropy (8bit):7.686753451899311
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:1f3v5+q2UtliFJGJVpHczJCMQFwdDC2oDCtEnPkEJA:Z3/tligVlccMQUDCpGtEnPkE6
                                                                                                                                                                                                                                            MD5:0212208FD406500388F08BC4189CC57E
                                                                                                                                                                                                                                            SHA1:79A82F1AC86D6C4BE3C3E4B0A790BFD4E2F6B27E
                                                                                                                                                                                                                                            SHA-256:A85170D26B9344DCA793C3B2326EC709D2F2D01578E78B855E82B14795B0025C
                                                                                                                                                                                                                                            SHA-512:33E7E2AE0B3D36D8E909CFFC993E6B36923E8775E780832F5D689C15D04712EA412B62CC709C53128D9ACAD34F1922CB9FEE90304DA2F879BEBEB4F3A67B9523
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......(.....6q.H....bKGD..............pHYs...#...#.x.?v....tIME.....7.6`......tEXtComment.Created with GIMPW.......IDATx..\1o.1.}g.?....J..L.XaA..:7.H,,.....0.2...R.t.TE....b..*.*.+...p...;..tCN...=?......uaRs.K%..[N9F.W....`[H.-...t.I...L.;.........!...?.\..|..{x.Z.@e}.....Jo......0zA..{<c...J=.8...*...YN...8[./G....o.9../.`F.....)PL.......s.&...Y.Hy.S.:.W..........9.^....h.w..8U b.O....zc..4*...../ %..OD..8.5....{.XY{..............d.<...tP.1..{o...%.f$F.....(.........D.....D6.i.....~v..m.2e.QS.k!V..K...xT.1}e.............\.y.u.1.>.pO...5.oZ...Ce.C.e.5}..l........[*39........:.E...[.....}...pOd#v..MK..)....S..5....{.T.N...l.M.ue..O.....`/........8.|.a7.T%.R5.x... .)U...:dw....9r.tJ..........N....N..^.S..R..W..Y.4....'...}...P.........0$Q;0',.bU@........A..Q.....<.L.)...`FDwhVX8..~.#...e.."a:6..L.P.-...".......K...a.T....r..Da0.T..=../...G.C...b.x....W....D.S....oFa...L..3....a,...u..].!.z...@+..NP......./.&...aX...9....`.R...:....w..{.`

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\link.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 128 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1101
                                                                                                                                                                                                                                            Entropy (8bit):7.686753451899311
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:1f3v5+q2UtliFJGJVpHczJCMQFwdDC2oDCtEnPkEJA:Z3/tligVlccMQUDCpGtEnPkE6
                                                                                                                                                                                                                                            MD5:0212208FD406500388F08BC4189CC57E
                                                                                                                                                                                                                                            SHA1:79A82F1AC86D6C4BE3C3E4B0A790BFD4E2F6B27E
                                                                                                                                                                                                                                            SHA-256:A85170D26B9344DCA793C3B2326EC709D2F2D01578E78B855E82B14795B0025C
                                                                                                                                                                                                                                            SHA-512:33E7E2AE0B3D36D8E909CFFC993E6B36923E8775E780832F5D689C15D04712EA412B62CC709C53128D9ACAD34F1922CB9FEE90304DA2F879BEBEB4F3A67B9523
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......(.....6q.H....bKGD..............pHYs...#...#.x.?v....tIME.....7.6`......tEXtComment.Created with GIMPW.......IDATx..\1o.1.}g.?....J..L.XaA..:7.H,,.....0.2...R.t.TE....b..*.*.+...p...;..tCN...=?......uaRs.K%..[N9F.W....`[H.-...t.I...L.;.........!...?.\..|..{x.Z.@e}.....Jo......0zA..{<c...J=.8...*...YN...8[./G....o.9../.`F.....)PL.......s.&...Y.Hy.S.:.W..........9.^....h.w..8U b.O....zc..4*...../ %..OD..8.5....{.XY{..............d.<...tP.1..{o...%.f$F.....(.........D.....D6.i.....~v..m.2e.QS.k!V..K...xT.1}e.............\.y.u.1.>.pO...5.oZ...Ce.C.e.5}..l........[*39........:.E...[.....}...pOd#v..MK..)....S..5....{.T.N...l.M.ue..O.....`/........8.|.a7.T%.R5.x... .)U...:dw....9r.tJ..........N....N..^.S..R..W..Y.4....'...}...P.........0$Q;0',.bU@........A..Q.....<.L.)...`FDwhVX8..~.#...e.."a:6..L.P.-...".......K...a.T....r..Da0.T..=../...G.C...b.x....W....D.S....oFa...L..3....a,...u..].!.z...@+..NP......./.&...aX...9....`.R...:....w..{.`

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-47GOH.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10057
                                                                                                                                                                                                                                            Entropy (8bit):4.490014854752693
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:ejQ2511mA/SZ1aHe768NxSnLuYd42QRDwdmxst8mHWVZyjqb/9rPj4Y8JYs5Rjkc:eH7eeeBJZhbN0X1R
                                                                                                                                                                                                                                            MD5:607A7C1AB93026D94916F21779D0D645
                                                                                                                                                                                                                                            SHA1:3D5A64B256FC44086E6E190EA0BC45B5999E1979
                                                                                                                                                                                                                                            SHA-256:EA61EEA6289C2FEBA7B7D0CC24DB5277E383102F24784E6BF7254AF41829599C
                                                                                                                                                                                                                                            SHA-512:D6749E2DBE46466A1CB1C464CE3F237836EF6B572EF897C7F5C9D12F80A6C0C7A5DFEA54C3499A91E14B29C8BBF0809CCE433C379F9E5DC0072E436F641C59AD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..function ceshare.GetCurrentProcessList().. ceshare.currentprocesslist={}.. .. for pid,name in pairs(getProcessList()) do.. local md5name=stringToMD5String(string.lower(name)).. --search processlist for this.. if ceshare.processlist and ceshare.processlist[md5name] then.. local e={}.. e.pid=pid.. e.name=name.. e.md5=md5name.. table.insert(ceshare.currentprocesslist,e).. end.. end.. .. return ceshare.currentprocesslist..end....function ceshare.DownloadProcessList().. --Downloads the processlist .. local i=ceshare.getInternet().. local processlist=i.getURL(ceshare.base..'processlist.txt').. .. if processlist==nil then.. return.. end.. .. if processlist:sub(1,1)=='<' then.. return --it returned html code instead of a md5 list.. end.. .. local f=io.open(ceshare.path..[[processlist.txt]],'wb').. if f then.. f:write(processlist).. f:close().... synchronize(function() ceshare.settings.Value.LastProcessListDownload=os.time(

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-4FINL.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3720
                                                                                                                                                                                                                                            Entropy (8bit):4.600809001198686
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:5JPi+sMwj8PiwwVtZw/FHesmsd6e2g8Qp18RHB0vjjmmNDARNbMymMNPuZdMUX28:5J6+sd4aw2ze/bPWh0RNaoy5uUY2hrEF
                                                                                                                                                                                                                                            MD5:65C8D4EDDFE05267A72EAE3DDB2CF02A
                                                                                                                                                                                                                                            SHA1:EEF2928D355C8B669F8854DA37162BA1FE32740A
                                                                                                                                                                                                                                            SHA-256:15B0C7682E5E8D2E2C2B8CB00C0C03B7DFA9439AC80C37F8E96A4F86652246F9
                                                                                                                                                                                                                                            SHA-512:1C151D5A44482362430FBC6ED4550671AD96E768942E4EC2A4C487182BED9D0326A0D40A1AC43F2C8A3DE1E18E33B055CE7126D80FEE9B5B7091ED83A22A41AD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Responsible for editing permissions on tables and changing the owner....function ceshare.ManageAccessList(entry).. if entry then.. .. if ceshare.Permissions==nil then.. local f=createFormFromFile(ceshare.formpath..'Permissions.FRM') .. ceshare.PermissionsFrm=f.. .. f.OnDestroy=function(s).. ceshare.settings.Value['PermissionsFrm.x']=s.left.. ceshare.settings.Value['PermissionsFrm.y']=s.top.. end.. .. f.lbUserNames.Width=f.canvas.getTextWidth('this is a very long username wtf').. f.lbUserNames.Height=f.canvas.getTextHeight('QWERTYjkl')*10.. .. f.lbUsernames.OnDblClick=function(s).. if s.ItemIndex~=-1 then.. s.Items.delete(s.ItemIndex).. end .. end.. .. f.btnAddUSer.OnClick=function(s).. local name=f.EdtUsername.Text.. if name~='' then.. f.lbUserNames.Items.add(name) .. end.. end.. .... local newx=ceshare.settings.Valu

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-4RT86.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5622
                                                                                                                                                                                                                                            Entropy (8bit):4.880391114169657
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:5cHxYq8COheJHVFvNmAYVL9rAaDu+WYtUX8T794B:5cLJHVF0AGBli+LtcYSB
                                                                                                                                                                                                                                            MD5:6CF99831E2AAAFB97E975EAE06A705FF
                                                                                                                                                                                                                                            SHA1:B6E71F7D3C779575598B65A6E4FB341344A3DDD2
                                                                                                                                                                                                                                            SHA-256:E9D57ACB17502AC169DEB37F211E472F68CD6E8A69E071D384B989FA45E9FA7F
                                                                                                                                                                                                                                            SHA-512:F6467C4C9DCAB563DBB5A337C76616208D1A1058D704B222E616E5A0809A156B1A29198919F4BF0D40C55A6E972439722C02AAC8A156C53572B6D7EF80986405
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:function ceshare.QueryProcessRequests(processname, startindex).. local result=nil.. if processname==nil or processname=='' then return end.. .. local parameters='processname='..ceshare.url_encode(processname).. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryProcessRequests.php', parameters).. if s then.. if s.RequestList then.. result={}.. .. for i=1, s.RequestList:numChildren() do.. local request=s.RequestList:children()[i].. local entry={}.. entry.ID=tonumber(request["@ID"]).. entry.Username=request["@username"].. entry.Message=request["@message"].. entry.Score=tonumber(request["@score"]).. entry.Time=request["@time"].. .. table.insert(result, entry).. end .. end.. end.. .. return result..end....function ceshare.createRequestPanel(request).. local panel=createPanel(ceshare.RequestsFrm.MessageBox).. panel.Align='al

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-8KNKB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4018
                                                                                                                                                                                                                                            Entropy (8bit):4.735117902416751
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:5ASgbBrZUxqShyY92Tm1E+J7YYI0+9+DKeRA453wxQRBhqvr5OOeCYBhSj:5ARB2hhPE+WY9+AzE5XsBhSj
                                                                                                                                                                                                                                            MD5:0D4D1B597712015EF1B0EC8ADC26495F
                                                                                                                                                                                                                                            SHA1:3584779C06619F545B47A27703AA2F47455D50DE
                                                                                                                                                                                                                                            SHA-256:89C8FCCC16D2AA0A3004DC1B477A5C1DCBBA539769B2A4558F7C7D9B9809B133
                                                                                                                                                                                                                                            SHA-512:AE26BBB2C3F74C143A01EC3B296A26699C679D51BC68C8C7B8C460616D1A0AA065500EBCA83E972A720BD7A3C5A7B63A673EAECEF1391A2E717208EF8DA0796F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:function ceshare.QueryTableComments(entry, startindex).. local result=nil.. local parameters='id='..entry.ID.. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryTableComments.php', parameters).. if s then.. if s.Comments then.. result={}.. .. for i=1, s.Comments:numChildren() do.. local comment=s.Comments:children()[i].. local entry={}.. entry.ID=tonumber(comment["@ID"]).. entry.Username=comment["@username"].. entry.Message=comment["@message"].. entry.Time=comment["@time"].. table.insert(result, entry).. end .. end.. end .. return result..end......function ceshare.createCommentPanel(comment).. local panel=createPanel(ceshare.CommentsFrm.MessageBox).. panel.Align='alTop' .. panel.Tag=comment.ID .. .. local pnlMessage=createPanel(panel).. pnlMessage.align='alClient'.. .. local lblUsername=createLabel(pnlMessage).. lblUsername.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-KFVE1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21455
                                                                                                                                                                                                                                            Entropy (8bit):4.719034004905997
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:K3KK7BDUUhaWlvyDep8IcDsfUPrBUpJRg:K3hDUUh3Kqp8X9UpPg
                                                                                                                                                                                                                                            MD5:87CD08B16891E0DBE3D47BB71CA91691
                                                                                                                                                                                                                                            SHA1:55D98338B4AA0DF3566CD2E721B3D3F86A3836AA
                                                                                                                                                                                                                                            SHA-256:6BFD35AA64AB566DDB68D0675AD3B4A093649010A9C30DF3A30A7F9DC2ED7702
                                                                                                                                                                                                                                            SHA-512:847BECF1D3066A3E185001035B68496B91876BDEB323734782C41FC9B2BDF665BF33C728CEBBE78E820654D87B1969C09B5D1FAED7498538CB5F761984108614
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local function isWindowVisible(winhandle).. return executeCodeLocal('IsWindowVisible',winhandle)~=0..end....local function getBaseParentFromWindowHandle(winhandle).. local i=0.. local last=winhandle.... while winhandle and (winhandle~=0) and (i<10000) do.. last=winhandle.. winhandle=getWindow(winhandle, GW_HWNDOWNER).. i=i+1.. end;.... return last..end....function ceshare.getProcessTitle(pid).. local w=getWindow(getForegroundWindow(), GW_HWNDFIRST).... local bases={}.... while w and (w~=0) do.. if getWindowProcessID(w)==pid then.. if isWindowVisible(w) then.. local h=getBaseParentFromWindowHandle(w).. local c=getWindowCaption(h).. if isWindowVisible(h) and (c~='') then.. bases[h]=c.. end.. end.. end.. w=getWindow(w,GW_HWNDNEXT).. end...... for h,n in pairs(bases) do.. return n --just hope for the best..... end..end....function ceshare.getCurrentProcessTitle().. return ceshare.getProcessTitle(getOpenedProce

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-LO9E6.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12865
                                                                                                                                                                                                                                            Entropy (8bit):4.882563186282491
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:08NVYz/SCrsKrYrygrL5UHsCYBv2S5OVhxPSidLhHYWZHHYzHuxN5FoXQuHNVcbU:Xod1grbuz9hHYWJaQCHqC
                                                                                                                                                                                                                                            MD5:665BB2E55E2A13157D1DBFEF05D1B905
                                                                                                                                                                                                                                            SHA1:408FEA33F574BD0FA9E4CB71958363398E0699BC
                                                                                                                                                                                                                                            SHA-256:DA6ECCE3DB7D305813FFE80CA994663D43F1068F0FB67399A4C66D1F28684BFA
                                                                                                                                                                                                                                            SHA-512:8FE95E22680E1E802D0CEEECBBD6B098526468B8CF4D838301D2833247D94E4F3B3A4B76A68F9FAAA2177B42FF2FFEA2DF46EF56A4A0CE501D126135CE8EE985
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local DPIMultiplier=(getScreenDPI()/96)..local ThumbnailWidth=240*DPIMultiplier..local ThumbnailHeight=80*DPIMultiplier....local DummyBitmap=createBitmap()..DummyBitmap.Canvas.Font.Size=12....local getListItemData,getThumbnail,generateListItemBitmap,getListItemBitmap..local cleanPage, setPage,getFullProcessList,filterList....--[[..ceshare.FullProcessList is the downloaded list which contains all entries..ceshare.FullProcessListView is the searchresult....--]]....local backgroundcolor....local darkMode=1..local windowColor,listColor,searchFieldColor,fontColor, fontSize, linkColor, highlightColor..if darkMode==1 then.. listColor=clBlack.. searchFieldColor=clBlack.. fontColor=clWhite.. windowColor=clBlack.. linkColor=0x0000ff.. highlightColor=0x00ff00..else .. listColor=clDefault.. searchFieldColor=clDefault.. fontColor=clDefault.. windowColor=clDefault.. linkColor=0xff0000.. highlightColor=clDefault..end....fontSize=12........function getListItemData(index).. local width..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-R7BFR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25075
                                                                                                                                                                                                                                            Entropy (8bit):4.523124761905836
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:RYDUUhQNWv2rzc3lytSv5ooI0/r5cCAn9zZMf4gybrby15VZ3faxLao0iH+WpeCC:uDUUhQ0OrbBKGYU63
                                                                                                                                                                                                                                            MD5:623B89F1E13C54A1F560B254317948B5
                                                                                                                                                                                                                                            SHA1:B90E2DE7A5CFF0B14738F2FB4F6A3A4E1EE1A17C
                                                                                                                                                                                                                                            SHA-256:0C6E90C2525F1560ACEA3F4BDAE056D11DF1C2F675C2335594DC80BB910A1B17
                                                                                                                                                                                                                                            SHA-512:F80CD50F860A5F8D5C6D6AB7BA8691B443DA91573F3F0FC8D5B82B79556C5AC02ACCC610870EA61A886ECB8A4491457965D082F8F41DF781DED1DB84F7157A3F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:function ceshare.enumModules2().. local m=enumModules().. local r={}.. .. for i=1,#m do.. r[m[i].Name:lower()]=m[i].. end.. .. return r..end....function ceshare.QueryProcessCheats(processname, headermd5, updatableOnly).. local modulelist=ceshare.enumModules2().. local result=nil.. local parameters='processname='..ceshare.url_encode(processname).. .. if isKeyPressed(VK_CONTROL)==false then --control lets you get a new script if needed.. local secondaryIdentifierCode=ceshare.secondaryIdentifierCode.Value[processname:lower()].. if secondaryIdentifierCode and secondaryIdentifierCode~='' then.. local value,param=loadstring(secondaryIdentifierCode)().. if value and param then.. parameters=parameters..'&secondaryidentifier='..ceshare.url_encode(param).. end.. end.. end.. .. if updatableOnly then.. parameters=parameters..'&updatableOnly=1';.. end.... .. .. .. --local r=ceshare.getInternet().postURL(url,parameters).. --local s=ceshare

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-VGT14.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6583
                                                                                                                                                                                                                                            Entropy (8bit):4.856845566130843
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:2m3dOvyXANbHC7jmHmQr2LHymHG21h5rSTW/S4XHhOLOxInDLnrTH2n8ruHqhV4Z:2m3UvyW9mL/N5XYFCoKmo
                                                                                                                                                                                                                                            MD5:0B5180BD64689788EBEAA8E705A264AC
                                                                                                                                                                                                                                            SHA1:43A5CC401EE6C4FF4A94697112B1BC1D4345FC19
                                                                                                                                                                                                                                            SHA-256:8FD38A5E6C0408CA77E0E7A0EE179B4391758EC6DA94EA289E3A2CBC1AB1EC59
                                                                                                                                                                                                                                            SHA-512:CC26E2E36B93BF89AA16C744B2DB60D855DE616DB7A67F4FB24135545104459338C3EDEAB42BB316B1ECB0DB9E31970B1415A1BF638EA3E53AE31471330AEADB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..function ceshare.login(username,password).. local i=ceshare.getInternet().. local parameters='';.. if username then.. parameters=parameters..'username='..ceshare.url_encode(username).. end .. .. if password then.. parameters=parameters..'&password='..ceshare.url_encode(password).. end.. .. local r=i.postURL(ceshare.base..'login.php',parameters).. if r then.. if (r:sub(1,2)=='<?') then.. local s=ceshare.xmlParser:ParseXmlText(r).. if s then.. if s.Valid then.. ceshare.LoggedIn=true.. return true .. else.. if s.error then.. ceshare.showError(s.error:value()).. end.. end.. else.. ceshare.showError(r).. end.. else.. ceshare.showError(r);.. end.. else.. ceshare.showError('Login system failure').. end..end....function ceshare.logout().. local i=ceshare.getInternet().. local parameters='';.. i.postURL(ceshare.base..'logout.php',parameters).. ceshare.Lo

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\CEJVMTI.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):50456
                                                                                                                                                                                                                                            Entropy (8bit):6.548128089503794
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:+B4cf1fqCWPiiyDf+TTmhX2cnX3/OtC2MD0OK9BRbAlQ4z:El38CfKmhXv/Ott20OKvR
                                                                                                                                                                                                                                            MD5:B02FA5C8EEFBCD010AAAC97A94FF62BB
                                                                                                                                                                                                                                            SHA1:FD88F2FC529515252CBCAB507F322B080853C38B
                                                                                                                                                                                                                                            SHA-256:7BD0D77FD790215BB67337F9F210B05AAAB0193D105B8FF86EC422E9875EB033
                                                                                                                                                                                                                                            SHA-512:1D18CB2CFFBF83EF949C2A34FA28C4E011C623C62CE743C7F320DB1ACFBD41BEA2EA6D3F0D93A34874973FC43367D6562C630F8B7912B22BE7CCC61851001A18
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6Nf;W 5;W 5;W 5...5:W 5%..58W 5%..56W 5%..5?W 5%..5?W 5..58W 5;W!5.W 5%..5=W 5%..5:W 5%..5:W 5Rich;W 5........PE..L...T.sS...........!.........(.......................................................=....@......................... .......T...P...............................p... ...................................@............................................text...2........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-QRS1L.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):50456
                                                                                                                                                                                                                                            Entropy (8bit):6.548128089503794
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:+B4cf1fqCWPiiyDf+TTmhX2cnX3/OtC2MD0OK9BRbAlQ4z:El38CfKmhXv/Ott20OKvR
                                                                                                                                                                                                                                            MD5:B02FA5C8EEFBCD010AAAC97A94FF62BB
                                                                                                                                                                                                                                            SHA1:FD88F2FC529515252CBCAB507F322B080853C38B
                                                                                                                                                                                                                                            SHA-256:7BD0D77FD790215BB67337F9F210B05AAAB0193D105B8FF86EC422E9875EB033
                                                                                                                                                                                                                                            SHA-512:1D18CB2CFFBF83EF949C2A34FA28C4E011C623C62CE743C7F320DB1ACFBD41BEA2EA6D3F0D93A34874973FC43367D6562C630F8B7912B22BE7CCC61851001A18
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6Nf;W 5;W 5;W 5...5:W 5%..58W 5%..56W 5%..5?W 5%..5?W 5..58W 5;W!5.W 5%..5=W 5%..5:W 5%..5:W 5Rich;W 5........PE..L...T.sS...........!.........(.......................................................=....@......................... .......T...P...............................p... ...................................@............................................text...2........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\CEJVMTI.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):62232
                                                                                                                                                                                                                                            Entropy (8bit):6.014187026705995
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:wm0hfdOrlHVzBkzORZN2UE0TjwNwqGN4cOlA/eQ4z:wNuVBaOohMFOlA/
                                                                                                                                                                                                                                            MD5:CEFC5C56720CA850CCB20FAF47733BD2
                                                                                                                                                                                                                                            SHA1:55F25CF4A7DE12607B085E8CFDBA0383F0207E9D
                                                                                                                                                                                                                                            SHA-256:F107DD69B4115864D289F364FAFC0E045FD3E9FC4BDE5586CE8C1BCF59CC65A7
                                                                                                                                                                                                                                            SHA-512:1B6FBA56FEAC4F4345B2F6CED82A3DDDACC3C0CB6F49C1D30105A8156B8DE851E34B9E31478C658C60D907C9F26237D2EFB7C2AB85ADB49905FDCCA6349A4DEE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.n.x...x...x......y...f...y...f...q...f...|...f...|......{...x...E...f...~...f...y...f...y...Richx...........................PE..d...I.sS.........." .........8...... ........................................ ............@.....................................................P...............................D... ................................................................................text...?........................... ..`.rdata...%.......&..................@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-LGQU1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):62232
                                                                                                                                                                                                                                            Entropy (8bit):6.014187026705995
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:wm0hfdOrlHVzBkzORZN2UE0TjwNwqGN4cOlA/eQ4z:wNuVBaOohMFOlA/
                                                                                                                                                                                                                                            MD5:CEFC5C56720CA850CCB20FAF47733BD2
                                                                                                                                                                                                                                            SHA1:55F25CF4A7DE12607B085E8CFDBA0383F0207E9D
                                                                                                                                                                                                                                            SHA-256:F107DD69B4115864D289F364FAFC0E045FD3E9FC4BDE5586CE8C1BCF59CC65A7
                                                                                                                                                                                                                                            SHA-512:1B6FBA56FEAC4F4345B2F6CED82A3DDDACC3C0CB6F49C1D30105A8156B8DE851E34B9E31478C658C60D907C9F26237D2EFB7C2AB85ADB49905FDCCA6349A4DEE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.n.x...x...x......y...f...y...f...q...f...|...f...|......{...x...E...f...~...f...y...f...y...Richx...........................PE..d...I.sS.........." .........8...... ........................................ ............@.....................................................P...............................D... ................................................................................text...?........................... ..`.rdata...%.......&..................@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\DotNetInterface.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):39840
                                                                                                                                                                                                                                            Entropy (8bit):7.158632953476479
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:3N8So6jKJjZr25rm7V1VaXLkjYr25rm3V1VaXLkjn:3N8FaeF2m7P012m3P0A
                                                                                                                                                                                                                                            MD5:ED7867296697880928F297914D80F211
                                                                                                                                                                                                                                            SHA1:1CC9B65D8F94A04EA59B7511DF522FCB68C275E9
                                                                                                                                                                                                                                            SHA-256:3DC9EA4350E99E6216DA0840C53ED8CCCA39BA7DF7A4146B47AFFCAB128A4432
                                                                                                                                                                                                                                            SHA-512:044FDECCB4A46EDF37BBEF8E6CBB36AC586A2AA505B34F71977A2E404FFF088A60FF8277D0251B23C7F5D090A337B4CB5AF1FEA1A638B408EEC6F334BC416AD8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..(...........G... ...`....... ...............................?....@..................................G..O....`...............0...k...........F..8............................................ ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc..............................@..B.................G......H.......L1..............................................................R.{.....(......o....*....0..'.........#.....{.......o.....3....*r...ps....zR.{.....(......o....*.0............#.....{.......o....&..(....*R.{.....(......o....*..0............#.....{.......o....&..(....*R.{.....(......o....*..0............#.....{.......o....&..(....*...0..&.......(.....o........i(.....{........io....*...0..)........(.......#.....{.......o....&(.....o....*....0..R........(......(.....rG..p.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector32.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):417184
                                                                                                                                                                                                                                            Entropy (8bit):6.7644491521368
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:CLM9vziuDEVmqU2Im5/P1OhGKexP+gVuQ:lLiuDEV15/tVP+ouQ
                                                                                                                                                                                                                                            MD5:C5B870CE07DA5206D8A81E139920B7DC
                                                                                                                                                                                                                                            SHA1:F868450ED5F886F084C00345C75143C65FD9338E
                                                                                                                                                                                                                                            SHA-256:EB26B38A604CF98B95A39FD249C0771E351061A9894D22284CDFE984E8FC7A6C
                                                                                                                                                                                                                                            SHA-512:7DFB3E9940EC0D14B42C77483F71274701C46483E65EE57A0853A31F688CC5C3D0C0AF2050229BA196D9BEFF9813F259E3F92EEC9D8352CC0E416FEB4EB1A6BE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.1t"o_'"o_'"o_'..'/o_'..'.o_'..'?o_'p.Z&.o_'p.[&.o_'p.\&4o_'+..'!o_'"o^'Go_'..V&'o_'.._&#o_'...'#o_'..]&#o_'Rich"o_'........................PE..L....".c...........!.....D..........T........`...............................0.......&....@.........................0...X.......(........................k.......>..0V..p............................V..@............`..l............................text....B.......D.................. ..`.rdata...N...`...P...H..............@..@.data....&..........................@....rsrc...............................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):548768
                                                                                                                                                                                                                                            Entropy (8bit):6.397563059744258
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:7dShHq6xdR8zWUjwmoRb2qORTCKTJ7PYn:Z6xdqzWUjwmr8n
                                                                                                                                                                                                                                            MD5:4237719534B21BB179480ED8BB23C0CC
                                                                                                                                                                                                                                            SHA1:A1C8DB76137B6131B7B8FE379841CB3DF62F3B7D
                                                                                                                                                                                                                                            SHA-256:15EE5851FF1B33E369B43C66D44E3D1452A212C2A37F337B680FE8BD88DF8748
                                                                                                                                                                                                                                            SHA-512:4ACE9A2CA9BEAF64A3B097922300E6BF46729375CB4DFA4BC3D81B0420FF28CD45C2CFDB9C05E4885DDD39CB6BF160D932BE4711C219302D684D23AFEADB4F72
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P..n.S..P..n.Q.YP..n.P..P..D.e..P...8...P...8...P...8...P...(1..P...P...P..I9...P..I9...P..I9]..P..I9...P..Rich.P..................PE..d....".c.........." .....X...................................................P............`.............................................X...h...(.... ..........h:.......k...0..........p...........................p................p...............................text....W.......X.................. ..`.rdata...)...p...*...\..............@..@.data...H7..........................@....pdata..h:.......<..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\dnd.dat (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 44.1 kHz, Stereo
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):54895
                                                                                                                                                                                                                                            Entropy (8bit):7.768231173906507
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:TEzw27ZEqFXUUj2CGLHfwa8OMerCYvLKtO0iEaF:TEzw27LFXXqBHfwa8OsZC
                                                                                                                                                                                                                                            MD5:C07B2CE2256D4DDE62F92CB684E23C02
                                                                                                                                                                                                                                            SHA1:1D1A234A9C1BDE7DC32867BEB8197A4BD8C6802B
                                                                                                                                                                                                                                            SHA-256:3F7948BFADE1F6A4F744580FB825330FB85668CD645CD6EE9F5915742584E932
                                                                                                                                                                                                                                            SHA-512:E0DEE259BCCF78D8EA64A2C0B7136FE5BC749564E9574DAD496AEEC6BC0DEF460A1CB2D5E63DA7CB62E6A2C31D497A8FF355305C58AA4A4BF9F9EE0C07636273
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:ID3.......TXXX.......major_brand.isom.TXXX.......minor_version.512.TXXX... ...compatible_brands.isomiso2mp41.TSSE.......Lavf58.45.100.............P.................................Info.......\................."$'*,/2479<>ACEHJMPSUXZ]_bdgilnqtvy|~......................................................Lavc58.91............$...........X....................0d....1...-.... ...... .....4.....`.1. x&1...O..~.B....0...N./..A....~...]k.ZD.B.E.`........=.n..3..)g.I.@.(..P!.....?5./|>.....!{.f*Gj*L'c............V..2d#...1...j.... ...... .....@.....B........?...%2....<...`,..5..s.>a..hU..A2....d\.......#..(6.?/../.}+.......bn........>..S...`.7r.$..`......S.....E...2DA...1!..n .F$A.-..X.@..@J.....HO....c... .1..@....]..Wk3....0.."...~...w..%.n.i.;................O.s......_..}....zldY...5..............rd.7=0 ....2DY...1 ..n .&$1.-..H.. .J..... ......(....A.. .$..2j'`.0...i.B" ,..:{..h0..92.df. ......94...."...Wt........'.^..o.6.X.&..8.X~!.aX.G..nUy...q....q,.e.(.'..0D]...3C..6.B.(X..L

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-4PQA1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):548768
                                                                                                                                                                                                                                            Entropy (8bit):6.397563059744258
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:7dShHq6xdR8zWUjwmoRb2qORTCKTJ7PYn:Z6xdqzWUjwmr8n
                                                                                                                                                                                                                                            MD5:4237719534B21BB179480ED8BB23C0CC
                                                                                                                                                                                                                                            SHA1:A1C8DB76137B6131B7B8FE379841CB3DF62F3B7D
                                                                                                                                                                                                                                            SHA-256:15EE5851FF1B33E369B43C66D44E3D1452A212C2A37F337B680FE8BD88DF8748
                                                                                                                                                                                                                                            SHA-512:4ACE9A2CA9BEAF64A3B097922300E6BF46729375CB4DFA4BC3D81B0420FF28CD45C2CFDB9C05E4885DDD39CB6BF160D932BE4711C219302D684D23AFEADB4F72
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P..n.S..P..n.Q.YP..n.P..P..D.e..P...8...P...8...P...8...P...(1..P...P...P..I9...P..I9...P..I9]..P..I9...P..Rich.P..................PE..d....".c.........." .....X...................................................P............`.............................................X...h...(.... ..........h:.......k...0..........p...........................p................p...............................text....W.......X.................. ..`.rdata...)...p...*...\..............@..@.data...H7..........................@....pdata..h:.......<..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-9KS7N.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 44.1 kHz, Stereo
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):54895
                                                                                                                                                                                                                                            Entropy (8bit):7.768231173906507
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:TEzw27ZEqFXUUj2CGLHfwa8OMerCYvLKtO0iEaF:TEzw27LFXXqBHfwa8OsZC
                                                                                                                                                                                                                                            MD5:C07B2CE2256D4DDE62F92CB684E23C02
                                                                                                                                                                                                                                            SHA1:1D1A234A9C1BDE7DC32867BEB8197A4BD8C6802B
                                                                                                                                                                                                                                            SHA-256:3F7948BFADE1F6A4F744580FB825330FB85668CD645CD6EE9F5915742584E932
                                                                                                                                                                                                                                            SHA-512:E0DEE259BCCF78D8EA64A2C0B7136FE5BC749564E9574DAD496AEEC6BC0DEF460A1CB2D5E63DA7CB62E6A2C31D497A8FF355305C58AA4A4BF9F9EE0C07636273
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:ID3.......TXXX.......major_brand.isom.TXXX.......minor_version.512.TXXX... ...compatible_brands.isomiso2mp41.TSSE.......Lavf58.45.100.............P.................................Info.......\................."$'*,/2479<>ACEHJMPSUXZ]_bdgilnqtvy|~......................................................Lavc58.91............$...........X....................0d....1...-.... ...... .....4.....`.1. x&1...O..~.B....0...N./..A....~...]k.ZD.B.E.`........=.n..3..)g.I.@.(..P!.....?5./|>.....!{.f*Gj*L'c............V..2d#...1...j.... ...... .....@.....B........?...%2....<...`,..5..s.>a..hU..A2....d\.......#..(6.?/../.}+.......bn........>..S...`.7r.$..`......S.....E...2DA...1!..n .F$A.-..X.@..@J.....HO....c... .1..@....]..Wk3....0.."...~...w..%.n.i.;................O.s......_..}....zldY...5..............rd.7=0 ....2DY...1 ..n .&$1.-..H.. .J..... ......(....A.. .$..2j'`.0...i.B" ,..:{..h0..92.df. ......94...."...Wt........'.^..o.6.X.&..8.X~!.aX.G..nUy...q....q,.e.(.'..0D]...3C..6.B.(X..L

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-OTCB4.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):39840
                                                                                                                                                                                                                                            Entropy (8bit):7.158632953476479
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:3N8So6jKJjZr25rm7V1VaXLkjYr25rm3V1VaXLkjn:3N8FaeF2m7P012m3P0A
                                                                                                                                                                                                                                            MD5:ED7867296697880928F297914D80F211
                                                                                                                                                                                                                                            SHA1:1CC9B65D8F94A04EA59B7511DF522FCB68C275E9
                                                                                                                                                                                                                                            SHA-256:3DC9EA4350E99E6216DA0840C53ED8CCCA39BA7DF7A4146B47AFFCAB128A4432
                                                                                                                                                                                                                                            SHA-512:044FDECCB4A46EDF37BBEF8E6CBB36AC586A2AA505B34F71977A2E404FFF088A60FF8277D0251B23C7F5D090A337B4CB5AF1FEA1A638B408EEC6F334BC416AD8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..(...........G... ...`....... ...............................?....@..................................G..O....`...............0...k...........F..8............................................ ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc..............................@..B.................G......H.......L1..............................................................R.{.....(......o....*....0..'.........#.....{.......o.....3....*r...ps....zR.{.....(......o....*.0............#.....{.......o....&..(....*R.{.....(......o....*..0............#.....{.......o....&..(....*R.{.....(......o....*..0............#.....{.......o....&..(....*...0..&.......(.....o........i(.....{........io....*...0..)........(.......#.....{.......o....&(.....o....*....0..R........(......(.....rG..p.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-Q14OP.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):417184
                                                                                                                                                                                                                                            Entropy (8bit):6.7644491521368
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:CLM9vziuDEVmqU2Im5/P1OhGKexP+gVuQ:lLiuDEV15/tVP+ouQ
                                                                                                                                                                                                                                            MD5:C5B870CE07DA5206D8A81E139920B7DC
                                                                                                                                                                                                                                            SHA1:F868450ED5F886F084C00345C75143C65FD9338E
                                                                                                                                                                                                                                            SHA-256:EB26B38A604CF98B95A39FD249C0771E351061A9894D22284CDFE984E8FC7A6C
                                                                                                                                                                                                                                            SHA-512:7DFB3E9940EC0D14B42C77483F71274701C46483E65EE57A0853A31F688CC5C3D0C0AF2050229BA196D9BEFF9813F259E3F92EEC9D8352CC0E416FEB4EB1A6BE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.1t"o_'"o_'"o_'..'/o_'..'.o_'..'?o_'p.Z&.o_'p.[&.o_'p.\&4o_'+..'!o_'"o^'Go_'..V&'o_'.._&#o_'...'#o_'..]&#o_'Rich"o_'........................PE..L....".c...........!.....D..........T........`...............................0.......&....@.........................0...X.......(........................k.......>..0V..p............................V..@............`..l............................text....B.......D.................. ..`.rdata...N...`...P...H..............@..@.data....&..........................@....rsrc...............................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\Pipe.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1551
                                                                                                                                                                                                                                            Entropy (8bit):5.315181220757938
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:Z4mZHEKQU5rJeoOIqGSAARYqdVpPaKQ673pD56aLFs6cG4YUXC/ArOdt2qFjQ02y:h5DO/GsnxHsnG7U0ArytNjQMf8W
                                                                                                                                                                                                                                            MD5:9F6258B7C0FAFDE9B1D0ED44FFEA7070
                                                                                                                                                                                                                                            SHA1:FDBF716E6FD03BB3D2671F854A997EA46EFAE26F
                                                                                                                                                                                                                                            SHA-256:D020D9CF2563F8B6021593FA604E9CFBE54BCB8B7361CCDBC220E543A6995045
                                                                                                                                                                                                                                            SHA-512:DD00A5F40CAA128CCAED782E6ABA697DBD24CA194F051EF1FA542B3ACAAA618E08C822ECEC45EAC4A37FB29C889DC4DF5BB99CA6F328F010C4F4931D88A3EE7B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:....#ifdef _WINDOWS..#include <Windows.h>..#else..#include "macport.h"....#define ReadFile ReadFilePipeWrapper..#define WriteFile WriteFilePipeWrapper..#endif....#include "Pipe.h"....//superclass to make pipe handling easier to work with....Pipe::Pipe(void)..{...pipehandle=0;...InitializeCriticalSection(&cs);..}....Pipe::~Pipe(void)..{...//check if someone forgot to clean it up...if ((pipehandle!=0) && (pipehandle!=INVALID_HANDLE_VALUE))...{..#ifdef _WINDOWS....CloseHandle(pipehandle);..#else.. ClosePipe(pipehandle);..#endif....pipehandle=0;...}..... ..}....void Pipe::Lock(void)..{...EnterCriticalSection(&cs);..}....void Pipe::Unlock(void)..{...LeaveCriticalSection(&cs);..}....void Pipe::Read(PVOID buf, unsigned int count)..{...DWORD br;...if (count==0) return;...if (ReadFile(pipehandle, buf, count, &br, NULL)==FALSE)....throw("Read Error");..}....void Pipe::Write(PVOID buf, unsigned int count)..{...DWORD bw;...if (count==0) return;...if (WriteFile(pipehandle, buf, count, &bw

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\Pipe.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):507
                                                                                                                                                                                                                                            Entropy (8bit):5.260462788158599
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:lb1HAq75T1m1une2Vevm7vmp3jmuWjs5rCTLz:lVBYUwmTmp3jmuWjsaz
                                                                                                                                                                                                                                            MD5:956C9C67FE3FA489547C1767AFB50EC4
                                                                                                                                                                                                                                            SHA1:BC76C3E7DF811B582EE153C43B986C8ED107E72A
                                                                                                                                                                                                                                            SHA-256:65DF81AA1A72667285733FF7515632D7C003B2C21B37D623FC3F6663738137C0
                                                                                                                                                                                                                                            SHA-512:3FD906CB79B534FC63336005A605EE092FB8B028AD660882C3324F72D794CB1198C13FC23390B1FA1E0E895C1963F293B3411EC4599D67A5B8B8FDFD77840200
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....#ifndef _WINDOWS..#include "macport.h"..#endif....class Pipe..{..private:.. CRITICAL_SECTION cs;..protected:...HANDLE pipehandle;..public:...void Read(PVOID buf, unsigned int count);...void Write(PVOID buf, unsigned int count);...BYTE ReadByte();...WORD ReadWord();...DWORD ReadDword();...UINT64 ReadQword();...void WriteByte(BYTE b);...void WriteWord(WORD b);...void WriteDword(DWORD b);...void WriteQword(UINT64 b);.....void Lock();...void Unlock();.....Pipe(void);...~Pipe(void);..};..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-GVCM9.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1551
                                                                                                                                                                                                                                            Entropy (8bit):5.315181220757938
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:Z4mZHEKQU5rJeoOIqGSAARYqdVpPaKQ673pD56aLFs6cG4YUXC/ArOdt2qFjQ02y:h5DO/GsnxHsnG7U0ArytNjQMf8W
                                                                                                                                                                                                                                            MD5:9F6258B7C0FAFDE9B1D0ED44FFEA7070
                                                                                                                                                                                                                                            SHA1:FDBF716E6FD03BB3D2671F854A997EA46EFAE26F
                                                                                                                                                                                                                                            SHA-256:D020D9CF2563F8B6021593FA604E9CFBE54BCB8B7361CCDBC220E543A6995045
                                                                                                                                                                                                                                            SHA-512:DD00A5F40CAA128CCAED782E6ABA697DBD24CA194F051EF1FA542B3ACAAA618E08C822ECEC45EAC4A37FB29C889DC4DF5BB99CA6F328F010C4F4931D88A3EE7B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:....#ifdef _WINDOWS..#include <Windows.h>..#else..#include "macport.h"....#define ReadFile ReadFilePipeWrapper..#define WriteFile WriteFilePipeWrapper..#endif....#include "Pipe.h"....//superclass to make pipe handling easier to work with....Pipe::Pipe(void)..{...pipehandle=0;...InitializeCriticalSection(&cs);..}....Pipe::~Pipe(void)..{...//check if someone forgot to clean it up...if ((pipehandle!=0) && (pipehandle!=INVALID_HANDLE_VALUE))...{..#ifdef _WINDOWS....CloseHandle(pipehandle);..#else.. ClosePipe(pipehandle);..#endif....pipehandle=0;...}..... ..}....void Pipe::Lock(void)..{...EnterCriticalSection(&cs);..}....void Pipe::Unlock(void)..{...LeaveCriticalSection(&cs);..}....void Pipe::Read(PVOID buf, unsigned int count)..{...DWORD br;...if (count==0) return;...if (ReadFile(pipehandle, buf, count, &br, NULL)==FALSE)....throw("Read Error");..}....void Pipe::Write(PVOID buf, unsigned int count)..{...DWORD bw;...if (count==0) return;...if (WriteFile(pipehandle, buf, count, &bw

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-O36UB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):507
                                                                                                                                                                                                                                            Entropy (8bit):5.260462788158599
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:lb1HAq75T1m1une2Vevm7vmp3jmuWjs5rCTLz:lVBYUwmTmp3jmuWjsaz
                                                                                                                                                                                                                                            MD5:956C9C67FE3FA489547C1767AFB50EC4
                                                                                                                                                                                                                                            SHA1:BC76C3E7DF811B582EE153C43B986C8ED107E72A
                                                                                                                                                                                                                                            SHA-256:65DF81AA1A72667285733FF7515632D7C003B2C21B37D623FC3F6663738137C0
                                                                                                                                                                                                                                            SHA-512:3FD906CB79B534FC63336005A605EE092FB8B028AD660882C3324F72D794CB1198C13FC23390B1FA1E0E895C1963F293B3411EC4599D67A5B8B8FDFD77840200
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....#ifndef _WINDOWS..#include "macport.h"..#endif....class Pipe..{..private:.. CRITICAL_SECTION cs;..protected:...HANDLE pipehandle;..public:...void Read(PVOID buf, unsigned int count);...void Write(PVOID buf, unsigned int count);...BYTE ReadByte();...WORD ReadWord();...DWORD ReadDword();...UINT64 ReadQword();...void WriteByte(BYTE b);...void WriteWord(WORD b);...void WriteDword(DWORD b);...void WriteQword(UINT64 b);.....void Lock();...void Unlock();.....Pipe(void);...~Pipe(void);..};..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI.sln (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1241
                                                                                                                                                                                                                                            Entropy (8bit):5.56652814239152
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:pPE7K71jtSk8H5IkT6GkTxkBZkm2kp6ckt8Ik/Tkk88W:pPAe1jtTeYQtYZ
                                                                                                                                                                                                                                            MD5:D602509D20C721D185D08DDFAB72EFD8
                                                                                                                                                                                                                                            SHA1:A7006EDA0FC346223377188F4941B39BE925E355
                                                                                                                                                                                                                                            SHA-256:F51DCDB8A36F5784994125E8F3451EA91A710FC844751319E839B448802E7A13
                                                                                                                                                                                                                                            SHA-512:02D79C2A4C1A175C38E35E08465B4C915FF2F185A10208F36C31B707AAE4E38BDB8E0F04F6DEE231622973ACBE12AD3A0B76EDFFBB69979337833C7E94A36108
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...Microsoft Visual Studio Solution File, Format Version 10.00..# Visual Studio 2008..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CEJVMTI", "CEJVMTI\CEJVMTI.vcproj", "{3C30A633-6797-4D59-936F-9A2A8CE79B25}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Win32 = Debug|Win32....Debug|x64 = Debug|x64....Release|Win32 = Release|Win32....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|Win32.ActiveCfg = Debug|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|Win32.Build.0 = Debug|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|x64.ActiveCfg = Debug|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|x64.Build.0 = Debug|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release|Win32.ActiveCfg = Release|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release|Win32.Build.0 = Release|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4789
                                                                                                                                                                                                                                            Entropy (8bit):5.316244410627971
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:7VupFugSq0HelONyzkBB9SFMJt9Knqk1Nd4Gl5CRTjwn67xahZ9X7s1uvQ8zVYWO:UFupqXdkEFWsnqUNd4GX/6GFo2Y
                                                                                                                                                                                                                                            MD5:021AA48BED78C67E3A7969BE8BC0BB5B
                                                                                                                                                                                                                                            SHA1:CCA95A2D7D82ED610245D3AE88DD19C339C402AC
                                                                                                                                                                                                                                            SHA-256:C9EF523D9ABCAC32BC86CC5E316C03749B64EC4BCE0343289C05E9366639696D
                                                                                                                                                                                                                                            SHA-512:D3E10547D368D50863CC781E1831C5FA6264FAA9CC64AF6114E7F4E21D361849BBEE0784F0D653BC824079E43BDD8AE8D02B5574520497B07E0022CBAAEF3C32
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// CEJVMTI.cpp : Defines the exported functions for the DLL application...//....#include "stdafx.h"..#include "CEJVMTI.h"..#include "JavaServer.h"..#include "JavaEventServer.h"....void JNICALL AgentThread(jvmtiEnv* jvmti_env, JNIEnv* jni_env, void* arg)..{...CJavaServer *s=new CJavaServer(jvmti_env, jni_env);.....s->Start();.....delete s;...OutputDebugStringA("Still alive");....}........jvmtiIterationControl JNICALL initialHeapIterate(jlong class_tag, jlong size, jlong* tag_ptr, void* user_data)..{...//OutputDebugStringA("Tagging object\n");...*tag_ptr=1;...return JVMTI_ITERATION_CONTINUE;..}....int LaunchServer(jvmtiEnv *env, JNIEnv *jni)..{...jclass threadclass=jni->FindClass("java/lang/Thread");...if (threadclass==0)...{....OutputDebugStringA("jni->FindClass(\"java/lang/Thread\") failure");....return 0;...}.....jmethodID threadinit=jni->GetMethodID(threadclass, "<init>", "()V");...if (threadinit==0)...{....OutputDebugStringA("jni->GetMethodID failure");....return 0;...}..........//e

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):836
                                                                                                                                                                                                                                            Entropy (8bit):5.079968529942336
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:CwCaxHbe4JGywvVwOPGkTAIbDNzHOqMfsqM98DU+V6E:vxHbe4kywBGkTAIfNzHOqMUqM98wc6E
                                                                                                                                                                                                                                            MD5:20AF26E2AB559DDC6CA1929834DA003E
                                                                                                                                                                                                                                            SHA1:7AE93554FBCEC9851F68F16A2EAED9C3F299CE5F
                                                                                                                                                                                                                                            SHA-256:18C5FB7CB71EB7B2D1835CE44B24E09213AA885C1407E4E2401FBD2D74970D8E
                                                                                                                                                                                                                                            SHA-512:B9FF67E715E0489D761424266EDA7049F40FE38E0EE4F595B1D4B43E6E9F829074827DC4EBBF9FF368BE02A90A9343117930C88ED5FBB8E3D8EEBDA43A857D90
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// The following ifdef block is the standard way of creating macros which make exporting ..// from a DLL simpler. All files within this DLL are compiled with the CEJVMTI_EXPORTS..// symbol defined on the command line. this symbol should not be defined on any project..// that uses this DLL. This way any other project whose source files include this file see ..// CEJVMTI_API functions as being imported from a DLL, whereas this DLL sees symbols..// defined with this macro as being exported...#ifdef CEJVMTI_EXPORTS..#define CEJVMTI_API __declspec(dllexport)..#else..#define CEJVMTI_API __declspec(dllimport)..#endif....// This class is exported from the CEJVMTI.dll..class CEJVMTI_API CCEJVMTI {..public:...CCEJVMTI(void);...// TODO: add your methods here...};....extern CEJVMTI_API int nCEJVMTI;....CEJVMTI_API int fnCEJVMTI(void);..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.vcproj (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10039
                                                                                                                                                                                                                                            Entropy (8bit):5.118940053099404
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:VnzWGB2Afbh77fByk+f8bi4n4w4RciFnFwFRyIF:RWGdfbhfB+f8bi4n4w4RciFnFwFRFF
                                                                                                                                                                                                                                            MD5:9EE34D72F0C9E158FCEBB31CD8878D6C
                                                                                                                                                                                                                                            SHA1:3F06D5E6E886961AF80FA823E2D52CE5CD0B84D8
                                                                                                                                                                                                                                            SHA-256:CAFE34E86117A15C4E0B40F12BCBB79CB6EF8F0AB8ED10DEF567357AB11637CD
                                                                                                                                                                                                                                            SHA-512:FB41AF029142289DE950BA7BC1512A586E9C9E2414F46BB755936637978D40ECA5D8E671369BE61ACD38E841BCD11C264E2DE55FBC087E91B4A7529FFE91A55B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="CEJVMTI"...ProjectGUID="{3C30A633-6797-4D59-936F-9A2A8CE79B25}"...RootNamespace="CEJVMTI"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="..\..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="E:\source\openjdk\jdk\src\share\javavm\export;E:

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9131
                                                                                                                                                                                                                                            Entropy (8bit):5.432032141224608
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:reWH42e/J83LkXasXVHMFyWH9MWUnsUeTxtbPYN9:C42RA4VL/RV
                                                                                                                                                                                                                                            MD5:59529578CDE1AE578ABCAAA331AA4FBA
                                                                                                                                                                                                                                            SHA1:33AB98509ED784580A259D1B310827C50B842F50
                                                                                                                                                                                                                                            SHA-256:E3795C3B94C84491A368C78FCBC4076BFADCA038AFE74DA2FA7FAB7415945658
                                                                                                                                                                                                                                            SHA-512:ACBD3884642E466D29FBE6D6A7337CCBAEC55147EA735098F9E463C6875B52B255480745847C3EFABCBAC72F9B72DD45CF259880A8D4700AFB68C3C07AC747BE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#include "StdAfx.h"..#include "JavaEventServer.h"......CJavaEventServer *old_eventserver=NULL;..CJavaEventServer *eventserver=NULL;....jvmtiEventCallbacks callbacks;......void JNICALL MethodLoad(jvmtiEnv *jvmti_env, jmethodID method, jint code_size, const void* code_addr, jint map_length, ..........const jvmtiAddrLocationMap* map, const void* compile_info)..{...if (eventserver)....eventserver->MethodLoad(jvmti_env, method, code_size, code_addr);....}....void JNICALL MethodUnload(jvmtiEnv *jvmti_env, jmethodID method, const void* code_addr)..{...if (eventserver)....eventserver->MethodUnload(jvmti_env, method, code_addr);..}....void JNICALL DynamicCodeGenerated(jvmtiEnv *jvmti_env, const char* name, const void* address, jint length)..{...if (eventserver)....eventserver->DynamicCodeGenerated(jvmti_env, name, address,length);..}....void JNICALL FieldModification(jvmtiEnv *jvmti_env, JNIEnv* jni_env, jthread thread, jmethodID method, jlocation location, jclass field_klass, jobject object, j

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1440
                                                                                                                                                                                                                                            Entropy (8bit):5.2417448709416385
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:l+LADzcCjadu1txScPArZXOuAR5qLtmWltXUC/sf4ADSt9:Ra2Sco9XOuAaplUC/sfy
                                                                                                                                                                                                                                            MD5:94DE75F30ECA367499F6C3CA7905048C
                                                                                                                                                                                                                                            SHA1:26B550FAC776E0647ECEB2B246086D07DBB1F12B
                                                                                                                                                                                                                                            SHA-256:289AF20BDC7D004491E224531CE0C267D251AEF5EBAD5F3FED1AF750679F26C9
                                                                                                                                                                                                                                            SHA-512:4A822471535DCEA02B5DD73CDE60C3965910F5187E0D7E1F1691E0483921DEE6C2B13E9BC3D1EC952186BCCAD6D05E79266C77BBF8060329C71715D3DA9B4496
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once..#include "pipe.h"....//pipe for transmitting java events like method load/free....#define EVENTCMD_METHODLOAD 0..#define EVENTCMD_METHODUNLOAD 1..#define EVENTCMD_DYNAMICCODEGENERATED 2..#define EVENTCMD_FIELDMODIFICATION 3..#define EVENTCMD_TERMINATED 255....using namespace std;....typedef struct..{...jfieldID fieldid;...jclass klass;...jobject object;..} FindWhatWritesEntry, *PFindWhatWritesEntry;....class CJavaEventServer :...public Pipe..{..private:...wchar_t pipename[256];...jvmtiEnv *jvmti_env;...vector<PFindWhatWritesEntry> FindWhatWritesList;....public:...CJavaEventServer(jvmtiEnv *jvmti_env);...~CJavaEventServer(void);.....void MethodLoad(jvmtiEnv *jvmti_env, jmethodID method, jint code_size, const void* code_addr);...void MethodUnload(jvmtiEnv *jvmti_env, jmethodID method, const void* code_addr);...void DynamicCodeGenerated(jvmtiEnv *jvmti_env, const char* name, const void* address, jint length);...void FieldModification(jvmtiEnv *jvmti_env, JNIEnv* jni_env, jth

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42621
                                                                                                                                                                                                                                            Entropy (8bit):5.318768758669348
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Qw5oITw/RTdMaf2lBpn/Z2jc/AKJlXCR5A6Qw/iNufJiTTvMm5ETln6H:V1TwU7BJRCZQw/iNuBiTTvMvl6H
                                                                                                                                                                                                                                            MD5:AFABA48AD9AFA999503CCAAC45DF0710
                                                                                                                                                                                                                                            SHA1:45FEF1F5289CB3FD353F43EFD13ECE034803C9CD
                                                                                                                                                                                                                                            SHA-256:E02208CA6EBED1999D9761CC865CE98EABA28966DC32F40B5789733E52783BF9
                                                                                                                                                                                                                                            SHA-512:66B995A75C6F90177BCE4DCC93783B1409D20B8FF1C318B79B8DD7C8FE6A1DEE2F0AB906F30C5390D1C7B043D4E99717BF6FBC267318932D066721294C663552
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#include "StdAfx.h"..#include "JavaServer.h"....using namespace std;....int serverid=0;..int tagcount=0;....CJavaServer::CJavaServer(jvmtiEnv* jvmti_env, JNIEnv* jni_env)..{...//create a named pipe...jvmtiCapabilities cap;.......this->jni=jni_env;...this->jvmti=jvmti_env;.......jvmti->GetCapabilities(&cap);.....if (serverid==0)....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d", GetCurrentProcessId());...else....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d_%d", GetCurrentProcessId(),serverid);.......serverid++;..}....void CJavaServer::CreatePipeandWaitForconnect(void)..{....if ((pipehandle) && (pipehandle!=INVALID_HANDLE_VALUE))...{....CloseHandle(pipehandle);....pipehandle=0;...}.....pipehandle=CreateNamedPipe(pipename, PIPE_ACCESS_DUPLEX, PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT, 1,256*1024, 16, INFINITE, NULL);...ConnectNamedPipe(pipehandle, NULL);..}....CJavaServer::~CJavaServer(void)..{....}....void CJavaServer::StartCodeCallbacks(void)..{...if (old_eventserve

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2957
                                                                                                                                                                                                                                            Entropy (8bit):5.440878996694979
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:ayZG0XyeJljj2/1lXdYTpCvLYsdiLYQFtbfmtTZzlLj:FG0XyeJp41ld8CTYFYQFF0
                                                                                                                                                                                                                                            MD5:8A6C5C03E9FEF26236D765C96CA20085
                                                                                                                                                                                                                                            SHA1:01C3F3D91B2EB573E0C92BB7B2F656A42A31FB1D
                                                                                                                                                                                                                                            SHA-256:962F6BA49567FD76AD41C87A10763249C320294A5C971B089E935B864E824AD3
                                                                                                                                                                                                                                            SHA-512:031FA1505CC5345144247B25A6791A265EFCD05ECEDAB5421215DFD6F30F64E6677EA5B23DF2BCE0118DC865C5C3AA67B704338BE9693663B8C1E26CF27A19C0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....#include "JavaEventServer.h"....#define JAVACMD_STARTCODECALLBACKS 0..#define JAVACMD_STOPCODECALLBACKS 1..#define JAVACMD_GETLOADEDCLASSES 2..#define JAVACMD_DEREFERENCELOCALOBJECT 3..#define JAVACMD_GETCLASSMETHODS 4..#define JAVACMD_GETCLASSFIELDS 5..#define JAVACMD_GETIMPLEMENTEDINTERFACES 6..#define JAVAVMD_FINDREFERENCESTOOBJECT 7..#define JAVACMD_FINDJOBJECT 8..#define JAVACMD_GETCLASSSIGNATURE 9..#define JAVACMD_GETSUPERCLASS 10..#define JAVACMD_GETOBJECTCLASS 11..#define JAVACMD_GETCLASSDATA 12..#define JAVACMD_REDEFINECLASS 13..#define JAVACMD_FINDCLASS 14..#define JAVACMD_GETCAPABILITIES 15..#define JAVACMD_GETMETHODNAME 16..#define JAVACMD_INVOKEMETHOD 17..#define JAVACMD_FINDCLASSOBJECTS 18..#define JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH 19..#define JAVACMD_ADDTOSYSTEMCLASSLOADERPATH 20..#define JAVACMD_PUSHLOCALFRAME 21..#define JAVACMD_POPLOCALFRAME 22..#define JAVACMD_GETFIELDDECLARINGCLASS 23..#define JAVACMD_GETFIELDSIGNATURE 24..#define JAVACMD_GETFIEL

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\dllmain.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):410
                                                                                                                                                                                                                                            Entropy (8bit):5.041995140928715
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:j/ltWmmylAoQw/UkKTQRWDKSRROaAOaWZKSR7Mjoa:rWy7VU9aWGM3wWQMcoa
                                                                                                                                                                                                                                            MD5:66EFA1B79D7AEF68DFA369074ABC9CAA
                                                                                                                                                                                                                                            SHA1:67C347B1F2F8712B0CABB60E7E111CA1B3171F38
                                                                                                                                                                                                                                            SHA-256:542E67D6247001859B6BB38C2AA085F5446371EB2F2385546E12D0BF275DE503
                                                                                                                                                                                                                                            SHA-512:09DFBE5F7D95BBA3D4B9107C872F8690F6A714888B3146CA3E1468E41588D872EEE68AE8C4CC96B85B73B6F96F450C1D20496D9401BC94932D6F357EE42A225E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"....BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:...case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-1QHF1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):294
                                                                                                                                                                                                                                            Entropy (8bit):4.740307510696171
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jGmyXH+5AMRNT15eAbyRFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglON:jGXXHJYx5fCE+yi5JlZ+4cWAoQB6mpcV
                                                                                                                                                                                                                                            MD5:2B573B5A4D6EC77A3138EC43A1B260C9
                                                                                                                                                                                                                                            SHA1:2A210A2645A2B8155CA8740211D6B366BA0D293D
                                                                                                                                                                                                                                            SHA-256:4CFBA14A6F738DD17BE066C3A8F595B84C0C33C1774C83736987B9EE8C0DF16B
                                                                                                                                                                                                                                            SHA-512:A04185BF7DA42D22F0AE01C55EFB7AA5FE0C5924820DF3AF2439B06E472131FB5659577B970834C08FBCA610A10EF41909B412B94B65BB5C8465047697647FDE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// stdafx.cpp : source file that includes just the standard includes..// CEJVMTI.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-2M6AB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4789
                                                                                                                                                                                                                                            Entropy (8bit):5.316244410627971
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:7VupFugSq0HelONyzkBB9SFMJt9Knqk1Nd4Gl5CRTjwn67xahZ9X7s1uvQ8zVYWO:UFupqXdkEFWsnqUNd4GX/6GFo2Y
                                                                                                                                                                                                                                            MD5:021AA48BED78C67E3A7969BE8BC0BB5B
                                                                                                                                                                                                                                            SHA1:CCA95A2D7D82ED610245D3AE88DD19C339C402AC
                                                                                                                                                                                                                                            SHA-256:C9EF523D9ABCAC32BC86CC5E316C03749B64EC4BCE0343289C05E9366639696D
                                                                                                                                                                                                                                            SHA-512:D3E10547D368D50863CC781E1831C5FA6264FAA9CC64AF6114E7F4E21D361849BBEE0784F0D653BC824079E43BDD8AE8D02B5574520497B07E0022CBAAEF3C32
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// CEJVMTI.cpp : Defines the exported functions for the DLL application...//....#include "stdafx.h"..#include "CEJVMTI.h"..#include "JavaServer.h"..#include "JavaEventServer.h"....void JNICALL AgentThread(jvmtiEnv* jvmti_env, JNIEnv* jni_env, void* arg)..{...CJavaServer *s=new CJavaServer(jvmti_env, jni_env);.....s->Start();.....delete s;...OutputDebugStringA("Still alive");....}........jvmtiIterationControl JNICALL initialHeapIterate(jlong class_tag, jlong size, jlong* tag_ptr, void* user_data)..{...//OutputDebugStringA("Tagging object\n");...*tag_ptr=1;...return JVMTI_ITERATION_CONTINUE;..}....int LaunchServer(jvmtiEnv *env, JNIEnv *jni)..{...jclass threadclass=jni->FindClass("java/lang/Thread");...if (threadclass==0)...{....OutputDebugStringA("jni->FindClass(\"java/lang/Thread\") failure");....return 0;...}.....jmethodID threadinit=jni->GetMethodID(threadclass, "<init>", "()V");...if (threadinit==0)...{....OutputDebugStringA("jni->GetMethodID failure");....return 0;...}..........//e

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-665F7.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9131
                                                                                                                                                                                                                                            Entropy (8bit):5.432032141224608
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:reWH42e/J83LkXasXVHMFyWH9MWUnsUeTxtbPYN9:C42RA4VL/RV
                                                                                                                                                                                                                                            MD5:59529578CDE1AE578ABCAAA331AA4FBA
                                                                                                                                                                                                                                            SHA1:33AB98509ED784580A259D1B310827C50B842F50
                                                                                                                                                                                                                                            SHA-256:E3795C3B94C84491A368C78FCBC4076BFADCA038AFE74DA2FA7FAB7415945658
                                                                                                                                                                                                                                            SHA-512:ACBD3884642E466D29FBE6D6A7337CCBAEC55147EA735098F9E463C6875B52B255480745847C3EFABCBAC72F9B72DD45CF259880A8D4700AFB68C3C07AC747BE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#include "StdAfx.h"..#include "JavaEventServer.h"......CJavaEventServer *old_eventserver=NULL;..CJavaEventServer *eventserver=NULL;....jvmtiEventCallbacks callbacks;......void JNICALL MethodLoad(jvmtiEnv *jvmti_env, jmethodID method, jint code_size, const void* code_addr, jint map_length, ..........const jvmtiAddrLocationMap* map, const void* compile_info)..{...if (eventserver)....eventserver->MethodLoad(jvmti_env, method, code_size, code_addr);....}....void JNICALL MethodUnload(jvmtiEnv *jvmti_env, jmethodID method, const void* code_addr)..{...if (eventserver)....eventserver->MethodUnload(jvmti_env, method, code_addr);..}....void JNICALL DynamicCodeGenerated(jvmtiEnv *jvmti_env, const char* name, const void* address, jint length)..{...if (eventserver)....eventserver->DynamicCodeGenerated(jvmti_env, name, address,length);..}....void JNICALL FieldModification(jvmtiEnv *jvmti_env, JNIEnv* jni_env, jthread thread, jmethodID method, jlocation location, jclass field_klass, jobject object, j

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-67UKC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):836
                                                                                                                                                                                                                                            Entropy (8bit):5.079968529942336
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:CwCaxHbe4JGywvVwOPGkTAIbDNzHOqMfsqM98DU+V6E:vxHbe4kywBGkTAIfNzHOqMUqM98wc6E
                                                                                                                                                                                                                                            MD5:20AF26E2AB559DDC6CA1929834DA003E
                                                                                                                                                                                                                                            SHA1:7AE93554FBCEC9851F68F16A2EAED9C3F299CE5F
                                                                                                                                                                                                                                            SHA-256:18C5FB7CB71EB7B2D1835CE44B24E09213AA885C1407E4E2401FBD2D74970D8E
                                                                                                                                                                                                                                            SHA-512:B9FF67E715E0489D761424266EDA7049F40FE38E0EE4F595B1D4B43E6E9F829074827DC4EBBF9FF368BE02A90A9343117930C88ED5FBB8E3D8EEBDA43A857D90
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// The following ifdef block is the standard way of creating macros which make exporting ..// from a DLL simpler. All files within this DLL are compiled with the CEJVMTI_EXPORTS..// symbol defined on the command line. this symbol should not be defined on any project..// that uses this DLL. This way any other project whose source files include this file see ..// CEJVMTI_API functions as being imported from a DLL, whereas this DLL sees symbols..// defined with this macro as being exported...#ifdef CEJVMTI_EXPORTS..#define CEJVMTI_API __declspec(dllexport)..#else..#define CEJVMTI_API __declspec(dllimport)..#endif....// This class is exported from the CEJVMTI.dll..class CEJVMTI_API CCEJVMTI {..public:...CCEJVMTI(void);...// TODO: add your methods here...};....extern CEJVMTI_API int nCEJVMTI;....CEJVMTI_API int fnCEJVMTI(void);..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-7TGHP.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10039
                                                                                                                                                                                                                                            Entropy (8bit):5.118940053099404
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:VnzWGB2Afbh77fByk+f8bi4n4w4RciFnFwFRyIF:RWGdfbhfB+f8bi4n4w4RciFnFwFRFF
                                                                                                                                                                                                                                            MD5:9EE34D72F0C9E158FCEBB31CD8878D6C
                                                                                                                                                                                                                                            SHA1:3F06D5E6E886961AF80FA823E2D52CE5CD0B84D8
                                                                                                                                                                                                                                            SHA-256:CAFE34E86117A15C4E0B40F12BCBB79CB6EF8F0AB8ED10DEF567357AB11637CD
                                                                                                                                                                                                                                            SHA-512:FB41AF029142289DE950BA7BC1512A586E9C9E2414F46BB755936637978D40ECA5D8E671369BE61ACD38E841BCD11C264E2DE55FBC087E91B4A7529FFE91A55B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="CEJVMTI"...ProjectGUID="{3C30A633-6797-4D59-936F-9A2A8CE79B25}"...RootNamespace="CEJVMTI"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="..\..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="E:\source\openjdk\jdk\src\share\javavm\export;E:

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-HR134.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1428
                                                                                                                                                                                                                                            Entropy (8bit):4.639223269334076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
                                                                                                                                                                                                                                            MD5:33F3A8E602AC6644AF839ACB3CA10709
                                                                                                                                                                                                                                            SHA1:0F76681306EBBE5063DA4C93919104D3E0134046
                                                                                                                                                                                                                                            SHA-256:0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
                                                                                                                                                                                                                                            SHA-512:81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-KRIHR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):542
                                                                                                                                                                                                                                            Entropy (8bit):4.851662037036262
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:jG0/fS4gZS4pSypyZbRAo9DGmreL5GAxA0jAiVvAihASAGjAz6cMqpcP6v:Fnapa9NBm5Gk/jfv3LBj9cMqpcs
                                                                                                                                                                                                                                            MD5:3718862895EA61A1A87FEB925092F535
                                                                                                                                                                                                                                            SHA1:7733DE8657B606A4BF18B844DEA6C500642EF964
                                                                                                                                                                                                                                            SHA-256:2FD0179BA87126CC35FB41D63FBEBBFBA185414960720B0A3DA652EC3B1AF641
                                                                                                                                                                                                                                            SHA-512:9357D5C4125F7CE8D2D31A72CFF04BA357565F69E0ED099076572C4E48B2A9E34C077D7462EBABC371952E6F9F48AAC17A1EFEE682573B49F7A7CF9752A41584
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#pragma once....#include "targetver.h"....#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers..// Windows Header Files:..#include <windows.h>..#include <jvmti.h>..#include <classfile_constants.h>..#include <pipe.h>..#include <map>..#include <list>..#include <vector>......// TODO: reference additional headers your program requires here..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-LM17N.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1440
                                                                                                                                                                                                                                            Entropy (8bit):5.2417448709416385
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:l+LADzcCjadu1txScPArZXOuAR5qLtmWltXUC/sf4ADSt9:Ra2Sco9XOuAaplUC/sfy
                                                                                                                                                                                                                                            MD5:94DE75F30ECA367499F6C3CA7905048C
                                                                                                                                                                                                                                            SHA1:26B550FAC776E0647ECEB2B246086D07DBB1F12B
                                                                                                                                                                                                                                            SHA-256:289AF20BDC7D004491E224531CE0C267D251AEF5EBAD5F3FED1AF750679F26C9
                                                                                                                                                                                                                                            SHA-512:4A822471535DCEA02B5DD73CDE60C3965910F5187E0D7E1F1691E0483921DEE6C2B13E9BC3D1EC952186BCCAD6D05E79266C77BBF8060329C71715D3DA9B4496
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once..#include "pipe.h"....//pipe for transmitting java events like method load/free....#define EVENTCMD_METHODLOAD 0..#define EVENTCMD_METHODUNLOAD 1..#define EVENTCMD_DYNAMICCODEGENERATED 2..#define EVENTCMD_FIELDMODIFICATION 3..#define EVENTCMD_TERMINATED 255....using namespace std;....typedef struct..{...jfieldID fieldid;...jclass klass;...jobject object;..} FindWhatWritesEntry, *PFindWhatWritesEntry;....class CJavaEventServer :...public Pipe..{..private:...wchar_t pipename[256];...jvmtiEnv *jvmti_env;...vector<PFindWhatWritesEntry> FindWhatWritesList;....public:...CJavaEventServer(jvmtiEnv *jvmti_env);...~CJavaEventServer(void);.....void MethodLoad(jvmtiEnv *jvmti_env, jmethodID method, jint code_size, const void* code_addr);...void MethodUnload(jvmtiEnv *jvmti_env, jmethodID method, const void* code_addr);...void DynamicCodeGenerated(jvmtiEnv *jvmti_env, const char* name, const void* address, jint length);...void FieldModification(jvmtiEnv *jvmti_env, JNIEnv* jni_env, jth

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-NCBT5.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):410
                                                                                                                                                                                                                                            Entropy (8bit):5.041995140928715
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:j/ltWmmylAoQw/UkKTQRWDKSRROaAOaWZKSR7Mjoa:rWy7VU9aWGM3wWQMcoa
                                                                                                                                                                                                                                            MD5:66EFA1B79D7AEF68DFA369074ABC9CAA
                                                                                                                                                                                                                                            SHA1:67C347B1F2F8712B0CABB60E7E111CA1B3171F38
                                                                                                                                                                                                                                            SHA-256:542E67D6247001859B6BB38C2AA085F5446371EB2F2385546E12D0BF275DE503
                                                                                                                                                                                                                                            SHA-512:09DFBE5F7D95BBA3D4B9107C872F8690F6A714888B3146CA3E1468E41588D872EEE68AE8C4CC96B85B73B6F96F450C1D20496D9401BC94932D6F357EE42A225E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"....BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:...case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-SLVPH.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):42621
                                                                                                                                                                                                                                            Entropy (8bit):5.318768758669348
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Qw5oITw/RTdMaf2lBpn/Z2jc/AKJlXCR5A6Qw/iNufJiTTvMm5ETln6H:V1TwU7BJRCZQw/iNuBiTTvMvl6H
                                                                                                                                                                                                                                            MD5:AFABA48AD9AFA999503CCAAC45DF0710
                                                                                                                                                                                                                                            SHA1:45FEF1F5289CB3FD353F43EFD13ECE034803C9CD
                                                                                                                                                                                                                                            SHA-256:E02208CA6EBED1999D9761CC865CE98EABA28966DC32F40B5789733E52783BF9
                                                                                                                                                                                                                                            SHA-512:66B995A75C6F90177BCE4DCC93783B1409D20B8FF1C318B79B8DD7C8FE6A1DEE2F0AB906F30C5390D1C7B043D4E99717BF6FBC267318932D066721294C663552
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#include "StdAfx.h"..#include "JavaServer.h"....using namespace std;....int serverid=0;..int tagcount=0;....CJavaServer::CJavaServer(jvmtiEnv* jvmti_env, JNIEnv* jni_env)..{...//create a named pipe...jvmtiCapabilities cap;.......this->jni=jni_env;...this->jvmti=jvmti_env;.......jvmti->GetCapabilities(&cap);.....if (serverid==0)....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d", GetCurrentProcessId());...else....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d_%d", GetCurrentProcessId(),serverid);.......serverid++;..}....void CJavaServer::CreatePipeandWaitForconnect(void)..{....if ((pipehandle) && (pipehandle!=INVALID_HANDLE_VALUE))...{....CloseHandle(pipehandle);....pipehandle=0;...}.....pipehandle=CreateNamedPipe(pipename, PIPE_ACCESS_DUPLEX, PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT, 1,256*1024, 16, INFINITE, NULL);...ConnectNamedPipe(pipehandle, NULL);..}....CJavaServer::~CJavaServer(void)..{....}....void CJavaServer::StartCodeCallbacks(void)..{...if (old_eventserve

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-U836T.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2957
                                                                                                                                                                                                                                            Entropy (8bit):5.440878996694979
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:ayZG0XyeJljj2/1lXdYTpCvLYsdiLYQFtbfmtTZzlLj:FG0XyeJp41ld8CTYFYQFF0
                                                                                                                                                                                                                                            MD5:8A6C5C03E9FEF26236D765C96CA20085
                                                                                                                                                                                                                                            SHA1:01C3F3D91B2EB573E0C92BB7B2F656A42A31FB1D
                                                                                                                                                                                                                                            SHA-256:962F6BA49567FD76AD41C87A10763249C320294A5C971B089E935B864E824AD3
                                                                                                                                                                                                                                            SHA-512:031FA1505CC5345144247B25A6791A265EFCD05ECEDAB5421215DFD6F30F64E6677EA5B23DF2BCE0118DC865C5C3AA67B704338BE9693663B8C1E26CF27A19C0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....#include "JavaEventServer.h"....#define JAVACMD_STARTCODECALLBACKS 0..#define JAVACMD_STOPCODECALLBACKS 1..#define JAVACMD_GETLOADEDCLASSES 2..#define JAVACMD_DEREFERENCELOCALOBJECT 3..#define JAVACMD_GETCLASSMETHODS 4..#define JAVACMD_GETCLASSFIELDS 5..#define JAVACMD_GETIMPLEMENTEDINTERFACES 6..#define JAVAVMD_FINDREFERENCESTOOBJECT 7..#define JAVACMD_FINDJOBJECT 8..#define JAVACMD_GETCLASSSIGNATURE 9..#define JAVACMD_GETSUPERCLASS 10..#define JAVACMD_GETOBJECTCLASS 11..#define JAVACMD_GETCLASSDATA 12..#define JAVACMD_REDEFINECLASS 13..#define JAVACMD_FINDCLASS 14..#define JAVACMD_GETCAPABILITIES 15..#define JAVACMD_GETMETHODNAME 16..#define JAVACMD_INVOKEMETHOD 17..#define JAVACMD_FINDCLASSOBJECTS 18..#define JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH 19..#define JAVACMD_ADDTOSYSTEMCLASSLOADERPATH 20..#define JAVACMD_PUSHLOCALFRAME 21..#define JAVACMD_POPLOCALFRAME 22..#define JAVACMD_GETFIELDDECLARINGCLASS 23..#define JAVACMD_GETFIELDSIGNATURE 24..#define JAVACMD_GETFIEL

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):294
                                                                                                                                                                                                                                            Entropy (8bit):4.740307510696171
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jGmyXH+5AMRNT15eAbyRFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglON:jGXXHJYx5fCE+yi5JlZ+4cWAoQB6mpcV
                                                                                                                                                                                                                                            MD5:2B573B5A4D6EC77A3138EC43A1B260C9
                                                                                                                                                                                                                                            SHA1:2A210A2645A2B8155CA8740211D6B366BA0D293D
                                                                                                                                                                                                                                            SHA-256:4CFBA14A6F738DD17BE066C3A8F595B84C0C33C1774C83736987B9EE8C0DF16B
                                                                                                                                                                                                                                            SHA-512:A04185BF7DA42D22F0AE01C55EFB7AA5FE0C5924820DF3AF2439B06E472131FB5659577B970834C08FBCA610A10EF41909B412B94B65BB5C8465047697647FDE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// stdafx.cpp : source file that includes just the standard includes..// CEJVMTI.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):542
                                                                                                                                                                                                                                            Entropy (8bit):4.851662037036262
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:jG0/fS4gZS4pSypyZbRAo9DGmreL5GAxA0jAiVvAihASAGjAz6cMqpcP6v:Fnapa9NBm5Gk/jfv3LBj9cMqpcs
                                                                                                                                                                                                                                            MD5:3718862895EA61A1A87FEB925092F535
                                                                                                                                                                                                                                            SHA1:7733DE8657B606A4BF18B844DEA6C500642EF964
                                                                                                                                                                                                                                            SHA-256:2FD0179BA87126CC35FB41D63FBEBBFBA185414960720B0A3DA652EC3B1AF641
                                                                                                                                                                                                                                            SHA-512:9357D5C4125F7CE8D2D31A72CFF04BA357565F69E0ED099076572C4E48B2A9E34C077D7462EBABC371952E6F9F48AAC17A1EFEE682573B49F7A7CF9752A41584
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#pragma once....#include "targetver.h"....#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers..// Windows Header Files:..#include <windows.h>..#include <jvmti.h>..#include <classfile_constants.h>..#include <pipe.h>..#include <map>..#include <list>..#include <vector>......// TODO: reference additional headers your program requires here..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\targetver.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1428
                                                                                                                                                                                                                                            Entropy (8bit):4.639223269334076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
                                                                                                                                                                                                                                            MD5:33F3A8E602AC6644AF839ACB3CA10709
                                                                                                                                                                                                                                            SHA1:0F76681306EBBE5063DA4C93919104D3E0134046
                                                                                                                                                                                                                                            SHA-256:0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
                                                                                                                                                                                                                                            SHA-512:81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\is-ALU8P.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1241
                                                                                                                                                                                                                                            Entropy (8bit):5.56652814239152
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:pPE7K71jtSk8H5IkT6GkTxkBZkm2kp6ckt8Ik/Tkk88W:pPAe1jtTeYQtYZ
                                                                                                                                                                                                                                            MD5:D602509D20C721D185D08DDFAB72EFD8
                                                                                                                                                                                                                                            SHA1:A7006EDA0FC346223377188F4941B39BE925E355
                                                                                                                                                                                                                                            SHA-256:F51DCDB8A36F5784994125E8F3451EA91A710FC844751319E839B448802E7A13
                                                                                                                                                                                                                                            SHA-512:02D79C2A4C1A175C38E35E08465B4C915FF2F185A10208F36C31B707AAE4E38BDB8E0F04F6DEE231622973ACBE12AD3A0B76EDFFBB69979337833C7E94A36108
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...Microsoft Visual Studio Solution File, Format Version 10.00..# Visual Studio 2008..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CEJVMTI", "CEJVMTI\CEJVMTI.vcproj", "{3C30A633-6797-4D59-936F-9A2A8CE79B25}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Win32 = Debug|Win32....Debug|x64 = Debug|x64....Release|Win32 = Release|Win32....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|Win32.ActiveCfg = Debug|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|Win32.Build.0 = Debug|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|x64.ActiveCfg = Debug|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug|x64.Build.0 = Debug|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release|Win32.ActiveCfg = Release|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release|Win32.Build.0 = Release|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector.sln (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1351
                                                                                                                                                                                                                                            Entropy (8bit):5.483553389434968
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:pPEkpnjkaUdex0H5p6DK/C868u8o2/b88W:pPTnjY6eqp8bo2/IZ
                                                                                                                                                                                                                                            MD5:9A2A2CADE7D370C563896D2C6F07D1C2
                                                                                                                                                                                                                                            SHA1:E01491AE49454E194C3B4DE2AE668AFEF27B3F3E
                                                                                                                                                                                                                                            SHA-256:287EE21B22308A8B979EB259417503D5B1542BBBF0859EE9344C085DE7866495
                                                                                                                                                                                                                                            SHA-512:CB9337B576030AF522180F16D8B52B36A9CC8099DB19A17D18CE92559C191CA4B61F27BBDA051E895A7E9455033BAB3C52FD057FA52F138F735DCC485F46B546
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.30723.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MonoDataCollector", "MonoDataCollector\MonoDataCollector.vcxproj", "{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Win32 = Debug|Win32....Debug|x64 = Debug|x64....Release|Win32 = Release|Win32....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|Win32.ActiveCfg = Debug|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|Win32.Build.0 = Debug|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|x64.ActiveCfg = Debug|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|x64.Build.0 = Debug|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Release|Win32.ActiveCfg = Release|Win32....{941726A

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\Metadata.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4749
                                                                                                                                                                                                                                            Entropy (8bit):5.050824950813426
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:iDz9qCj948ryMvEsMXoQ/O04a0smj9Mn/jMi/Y3SfsdIrmjFFZpmb/RmAdnEm1pd:g5p1O33Bk+QF9jeh9pBdPpFN
                                                                                                                                                                                                                                            MD5:1E571535D8459B8A3FCBA0C9E4871FA4
                                                                                                                                                                                                                                            SHA1:1C0F2CED9985BA808A648C9D95D7DB5076082985
                                                                                                                                                                                                                                            SHA-256:E66368085DB41EF91395CC1212A970117376B5B535E97F291FD71B2277BA9619
                                                                                                                                                                                                                                            SHA-512:3369613A4BDE6B49C73AD70E8DF2EBE7BD1C05FD0D7CBC5E87C5F1F3408FA36F8D7A40C19B097E541A649D7C0F30EE9FDB46B677E926A7A862FA2B794FDC9A80
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview://original source: blob.h in the mono sourcecode....../*.. * Encoding for type signatures used in the Metadata.. */..typedef enum {...MONO_TYPE_END = 0x00, /* End of List */...MONO_TYPE_VOID = 0x01,...MONO_TYPE_BOOLEAN = 0x02,...MONO_TYPE_CHAR = 0x03,...MONO_TYPE_I1 = 0x04,...MONO_TYPE_U1 = 0x05,...MONO_TYPE_I2 = 0x06,...MONO_TYPE_U2 = 0x07,...MONO_TYPE_I4 = 0x08,...MONO_TYPE_U4 = 0x09,...MONO_TYPE_I8 = 0x0a,...MONO_TYPE_U8 = 0x0b,...MONO_TYPE_R4 = 0x0c,...MONO_TYPE_R8 = 0x0d,...MONO_TYPE_STRING = 0x0e,...MONO_TYPE_PTR = 0x0f, /* arg: <type> token */...MONO_TYPE_BYREF = 0x10, /* arg: <type> token */...MONO_TYPE_VALUETYPE = 0x11, /* arg: <type> token */...MONO_TYPE_CLASS = 0x12, /* arg: <type> token */...MONO_TYPE_VAR. = 0x13,. /* number */...MONO_TYPE_ARRAY = 0x14, /* type, rank, boundsCount, bound1, loCount, lo1 */..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3498
                                                                                                                                                                                                                                            Entropy (8bit):5.386752810495523
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:ycfIokZotRYYftF1//JlB/R+reZhIxL3HmVZirMiKH8gEIsrdGXCYIr/J+Nn35t1:tAokZotRYYftF1//JlB/R+qZhIxL3Hm1
                                                                                                                                                                                                                                            MD5:35C7C5B4162098879D86CA2D5D7403E7
                                                                                                                                                                                                                                            SHA1:BDB921B2A10398DE218F33EDD4028E2B247F8592
                                                                                                                                                                                                                                            SHA-256:6F971E6E28F95B72775FA0D85922F58FC6BB5B68B34DB72C9D2F69E9374CA09C
                                                                                                                                                                                                                                            SHA-512:70C259E5C01D1EAD0694ADEBAC7639998A2EA3ECB52961B22F74C113669CCD50F80E884EF30D8DEB02028736A06B71F82F3A80EE20121613F8F3049C4D8D2655
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifdef _WINDOWS..#include "stdafx.h"..#elif __linux__..#include "linuxport.h"..#else..#include "macport.h"..#endif....#include "PipeServer.h"........HANDLE DataCollectorThread;..HANDLE SuicideThread;..HINSTANCE g_hInstance;....typedef enum _THREADINFOCLASS {.. ThreadBasicInformation,.. ThreadTimes,.. ThreadPriority,.. ThreadBasePriority,.. ThreadAffinityMask,.. ThreadImpersonationToken,.. ThreadDescriptorTableEntry,.. ThreadEnableAlignmentFaultFixup,.. ThreadEventPair_Reusable,.. ThreadQuerySetWin32StartAddress,.. ThreadZeroTlsCell,.. ThreadPerformanceCount,.. ThreadAmILastThread,.. ThreadIdealProcessor,.. ThreadPriorityBoost,.. ThreadSetTlsArrayAddress, // Obsolete.. ThreadIsIoPending,.. ThreadHideFromDebugger,.. ThreadBreakOnTermination,.. ThreadSwitchLegacyState,.. ThreadIsTerminated,.. ThreadLastSystemCall,.. ThreadIoPriority,.. ThreadCycleTime,.. ThreadPagePriority,.. ThreadActualBasePriority,.. Thr

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):361
                                                                                                                                                                                                                                            Entropy (8bit):5.139139694869984
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:2+bxmgVJAl3JmgRF80JRiCIqj/uFSJAQaP5a0Tj/5vpL5a0iTVDzz4jLxwLDPVMy:lbxVJAl5XRF1JTfJAQQQIxvpLQ/PSNw/
                                                                                                                                                                                                                                            MD5:A9DA212C35E442501960243A47A7C4DA
                                                                                                                                                                                                                                            SHA1:DA608C4AA6EEF1755F29366EA40BF826F07FFEB3
                                                                                                                                                                                                                                            SHA-256:23042548A0B202F76F0B66332844D796FC20C4FB4937D92299156E503ABC3F1D
                                                                                                                                                                                                                                            SHA-512:8A6C5A941C051C52C9DF9B151B354F3C82ED4E8041D000CD6DC2869A99C16064F753A9B6391F15A0A51CDB3CC9972FA0D3F3F191BA813BA00FD6A185D042BD76
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....extern HANDLE DataCollectorThread;..extern HANDLE SuicideThread;..extern HINSTANCE g_hInstance;..DWORD WINAPI DataCollectorEntry(LPVOID lpThreadParameter);..DWORD WINAPI SuicideCheck(LPVOID lpThreadParameter);....#ifdef __APPLE__..void MacPortEntryPoint(void *param);..#endif....#ifdef __linux__..void LinuxPortEntryPoint(void *param);..#endif..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.vcproj (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5600
                                                                                                                                                                                                                                            Entropy (8bit):5.094870445203132
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:drlz+71S6oa5zNq5+NtoottAipiwpHipfwp56q3bI4:Zp+skNca8i4whiFwyqb
                                                                                                                                                                                                                                            MD5:005A2F50AB3176D92010BE6DDF941655
                                                                                                                                                                                                                                            SHA1:9978E4C49D43172F8855A4748168345F2CA5BFF5
                                                                                                                                                                                                                                            SHA-256:A73AE1CBF54A722CE9433DA14D0600AFD504B09F5F681ED4BE9C9F5EF0E16A38
                                                                                                                                                                                                                                            SHA-512:8EC75F7B33F5C97853B63675621430A4C3975E8D6737A546D5983917E2C5FF17D4B6517FBA9D74F0F7C61CF4111F101B1231A97556A09908EC3B5EDF843859F2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="MonoDataCollector"...ProjectGUID="{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"...RootNamespace="MonoDataCollector"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="..\..\Common"......PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):71747
                                                                                                                                                                                                                                            Entropy (8bit):5.443198228857467
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:23vsKL5IB9DGdvGgFmk2N8VBFFlIsc8bOJObk:20Kq8VBFNc85k
                                                                                                                                                                                                                                            MD5:6E26B821A5660C3FB1414DBBA46636BF
                                                                                                                                                                                                                                            SHA1:E5AFF92AABB4C902CA2CE617DD2546956648C462
                                                                                                                                                                                                                                            SHA-256:F125B75EE7CAC4F30B9C399B6A371B62A3960E4DB11A64F8937E469B9C2BDD40
                                                                                                                                                                                                                                            SHA-512:647514B0E0537F3018DB7F500FDA81801AB68E02F663892E4D3A3A9A71CBD303A356371C227BBAC3154E883AEFEDDEC699CF40C99B2096E6F993B8B857C2A316
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifdef _WINDOWS..#include "StdAfx.h"..#endif....#ifdef __APPLE__..#include "macport.h"..#endif....#include <setjmp.h>..#ifdef __linux__..#include <signal.h>..#include <sys/types.h>..#include <string.h>..#include <unistd.h>..#include <sys/syscall.h>....#if __GLIBC__ == 2 && __GLIBC_MINOR__ < 30..#define gettid() syscall(SYS_gettid)..#endif....#endif //linux........#include <signal.h>..#include <sys/types.h>....#include "PipeServer.h"........BOOL ExpectingAccessViolations = FALSE;....#ifdef _WINDOWS..#pragma warning( disable : 4101)..HANDLE MDC_ServerPipe = 0;..DWORD ExpectingAccessViolationsThread = 0;..#else..uint64_t ExpectingAccessViolationsThread = 0;..#endif....typedef uint64_t QWORD;......jmp_buf onError;....void ErrorThrow(void)..{...longjmp(onError, 1);..}......#ifdef _WINDOWS......int looper = 0;..LONG NTAPI ErrorFilter(struct _EXCEPTION_POINTERS *ExceptionInfo)..{...if ((ExpectingAccessViolations) && (GetCurrentThreadId() == ExpectingAccessViolationsThread) && (ExceptionInfo->

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17047
                                                                                                                                                                                                                                            Entropy (8bit):5.4217354569721214
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:cBl0g5ShHzjEs2eI4Nw6YolkVXWNcN5qHyVGwuY0aUO+HXL:cBl1Y0j67lkVXWNcNiywbb
                                                                                                                                                                                                                                            MD5:359419B5EAD252EE248BE37873672D8E
                                                                                                                                                                                                                                            SHA1:0E18258FFC1E29A9E53824A8F86383E1BC2FC603
                                                                                                                                                                                                                                            SHA-256:FA4715152CC91D2F6C5C170FADDA74961A2CB12809F560AA37A34F7C185C76F0
                                                                                                                                                                                                                                            SHA-512:0F757B21B356676FE376D99F64189D86795FD6E9DB411B661A517E1B20172D7183129CC8762DB7E19DD83C826AFD57B6C35AFDCBAEC05C2AF83C6496F7C4D2D6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....#include <Pipe.h>..#ifndef _WINDOWS..#include "Metadata.h"..#endif...... //yyyymmdd..#define MONO_DATACOLLECTORVERSION 20221207 ....#define MONOCMD_INITMONO 0..#define MONOCMD_OBJECT_GETCLASS 1..#define MONOCMD_ENUMDOMAINS 2..#define MONOCMD_SETCURRENTDOMAIN 3..#define MONOCMD_ENUMASSEMBLIES 4..#define MONOCMD_GETIMAGEFROMASSEMBLY 5..#define MONOCMD_GETIMAGENAME 6..#define MONOCMD_ENUMCLASSESINIMAGE 7..#define MONOCMD_ENUMFIELDSINCLASS 8..#define MONOCMD_ENUMMETHODSINCLASS 9..#define MONOCMD_COMPILEMETHOD 10....#define MONOCMD_GETMETHODHEADER 11..#define MONOCMD_GETMETHODHEADER_CODE 12..#define MONOCMD_LOOKUPRVA 13..#define MONOCMD_GETJITINFO 14..#define MONOCMD_FINDCLASS 15..#define MONOCMD_FINDMETHOD 16..#define MONOCMD_GETMETHODNAME 17..#define MONOCMD_GETMETHODCLASS 18..#define MONOCMD_GETCLASSNAME 19..#define MONOCMD_GETCLASSNAMESPACE 20..#define MONOCMD_FREEMETHOD 21..#define MONOCMD_TERMINATE 22..#define MONOCMD_DISASSEMBLE 23..#def

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\dllmain.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):682
                                                                                                                                                                                                                                            Entropy (8bit):5.267391865519074
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:j/ltWmmylAoQ3/UkKTzuKTRWDKSRWMqIJCJAlosePSJAQnxPs5rF43oLOaAOaWZW:rWy7sU9zu6WGMKIAXsCStxPs5rF43olG
                                                                                                                                                                                                                                            MD5:4A220BB5A39A19E5E63123E8BA31FAF9
                                                                                                                                                                                                                                            SHA1:3E6667ED6E85E021FD9091C8EB2FDCA3C2DDEF41
                                                                                                                                                                                                                                            SHA-256:01F9B1931FDC3D8CB1B82D759A182AE617AF8986846A2B6F23092F78A39C8AD7
                                                                                                                                                                                                                                            SHA-512:734FD1ACEEE62A86A56DFC94E6E6FF264AE924AADFDC47EAC405E252FE3965633992D192CFAC6068AD7F2CAA170B594A0839D09ECE60976A27A363F69C1E1A5D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"......BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...OutputDebugStringA("MDC: DllMain");...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:....//OutputDebugStringA("DllMain entry");....g_hInstance=hModule;....DataCollectorThread=CreateThread(NULL, 0, DataCollectorEntry, NULL, 0, NULL);....SuicideThread=0;//CreateThread(NULL, 0, SuicideCheck, NULL, 0, NULL);....break;.....case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-ARBUH.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5600
                                                                                                                                                                                                                                            Entropy (8bit):5.094870445203132
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:drlz+71S6oa5zNq5+NtoottAipiwpHipfwp56q3bI4:Zp+skNca8i4whiFwyqb
                                                                                                                                                                                                                                            MD5:005A2F50AB3176D92010BE6DDF941655
                                                                                                                                                                                                                                            SHA1:9978E4C49D43172F8855A4748168345F2CA5BFF5
                                                                                                                                                                                                                                            SHA-256:A73AE1CBF54A722CE9433DA14D0600AFD504B09F5F681ED4BE9C9F5EF0E16A38
                                                                                                                                                                                                                                            SHA-512:8EC75F7B33F5C97853B63675621430A4C3975E8D6737A546D5983917E2C5FF17D4B6517FBA9D74F0F7C61CF4111F101B1231A97556A09908EC3B5EDF843859F2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="MonoDataCollector"...ProjectGUID="{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"...RootNamespace="MonoDataCollector"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="..\..\Common"......PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-BIDU2.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):304
                                                                                                                                                                                                                                            Entropy (8bit):4.661406565301994
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jGmyXH+5AMRNT15eAaiErJAhQFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcV:jGXXHJYx5fanrJAKE+yi5JlZ+4cWAoQI
                                                                                                                                                                                                                                            MD5:520DEFE1897C77FCE677BE903979DCA0
                                                                                                                                                                                                                                            SHA1:0EB32160624E8E3B72DF97E440EFCB211A09595C
                                                                                                                                                                                                                                            SHA-256:71E91D8847E8A4E4A757E441B7D785EDDDA95D55FF674E5054D0FDF781773361
                                                                                                                                                                                                                                            SHA-512:337D2893FB92760955D04E788E753B95C835A085929ED4144654899F9A54B96E84A7682A3C7885AA24F98E53FD5B2A2AC03D3F261CD3725F7D15E4422A2942A0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// stdafx.cpp : source file that includes just the standard includes..// MonoDataCollector.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-CG8FN.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1428
                                                                                                                                                                                                                                            Entropy (8bit):4.639223269334076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
                                                                                                                                                                                                                                            MD5:33F3A8E602AC6644AF839ACB3CA10709
                                                                                                                                                                                                                                            SHA1:0F76681306EBBE5063DA4C93919104D3E0134046
                                                                                                                                                                                                                                            SHA-256:0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
                                                                                                                                                                                                                                            SHA-512:81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-D49SI.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):682
                                                                                                                                                                                                                                            Entropy (8bit):5.267391865519074
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:j/ltWmmylAoQ3/UkKTzuKTRWDKSRWMqIJCJAlosePSJAQnxPs5rF43oLOaAOaWZW:rWy7sU9zu6WGMKIAXsCStxPs5rF43olG
                                                                                                                                                                                                                                            MD5:4A220BB5A39A19E5E63123E8BA31FAF9
                                                                                                                                                                                                                                            SHA1:3E6667ED6E85E021FD9091C8EB2FDCA3C2DDEF41
                                                                                                                                                                                                                                            SHA-256:01F9B1931FDC3D8CB1B82D759A182AE617AF8986846A2B6F23092F78A39C8AD7
                                                                                                                                                                                                                                            SHA-512:734FD1ACEEE62A86A56DFC94E6E6FF264AE924AADFDC47EAC405E252FE3965633992D192CFAC6068AD7F2CAA170B594A0839D09ECE60976A27A363F69C1E1A5D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"......BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...OutputDebugStringA("MDC: DllMain");...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:....//OutputDebugStringA("DllMain entry");....g_hInstance=hModule;....DataCollectorThread=CreateThread(NULL, 0, DataCollectorEntry, NULL, 0, NULL);....SuicideThread=0;//CreateThread(NULL, 0, SuicideCheck, NULL, 0, NULL);....break;.....case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-DQKDK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):361
                                                                                                                                                                                                                                            Entropy (8bit):5.139139694869984
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:2+bxmgVJAl3JmgRF80JRiCIqj/uFSJAQaP5a0Tj/5vpL5a0iTVDzz4jLxwLDPVMy:lbxVJAl5XRF1JTfJAQQQIxvpLQ/PSNw/
                                                                                                                                                                                                                                            MD5:A9DA212C35E442501960243A47A7C4DA
                                                                                                                                                                                                                                            SHA1:DA608C4AA6EEF1755F29366EA40BF826F07FFEB3
                                                                                                                                                                                                                                            SHA-256:23042548A0B202F76F0B66332844D796FC20C4FB4937D92299156E503ABC3F1D
                                                                                                                                                                                                                                            SHA-512:8A6C5A941C051C52C9DF9B151B354F3C82ED4E8041D000CD6DC2869A99C16064F753A9B6391F15A0A51CDB3CC9972FA0D3F3F191BA813BA00FD6A185D042BD76
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....extern HANDLE DataCollectorThread;..extern HANDLE SuicideThread;..extern HINSTANCE g_hInstance;..DWORD WINAPI DataCollectorEntry(LPVOID lpThreadParameter);..DWORD WINAPI SuicideCheck(LPVOID lpThreadParameter);....#ifdef __APPLE__..void MacPortEntryPoint(void *param);..#endif....#ifdef __linux__..void LinuxPortEntryPoint(void *param);..#endif..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-KGL2P.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17047
                                                                                                                                                                                                                                            Entropy (8bit):5.4217354569721214
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:cBl0g5ShHzjEs2eI4Nw6YolkVXWNcN5qHyVGwuY0aUO+HXL:cBl1Y0j67lkVXWNcNiywbb
                                                                                                                                                                                                                                            MD5:359419B5EAD252EE248BE37873672D8E
                                                                                                                                                                                                                                            SHA1:0E18258FFC1E29A9E53824A8F86383E1BC2FC603
                                                                                                                                                                                                                                            SHA-256:FA4715152CC91D2F6C5C170FADDA74961A2CB12809F560AA37A34F7C185C76F0
                                                                                                                                                                                                                                            SHA-512:0F757B21B356676FE376D99F64189D86795FD6E9DB411B661A517E1B20172D7183129CC8762DB7E19DD83C826AFD57B6C35AFDCBAEC05C2AF83C6496F7C4D2D6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....#include <Pipe.h>..#ifndef _WINDOWS..#include "Metadata.h"..#endif...... //yyyymmdd..#define MONO_DATACOLLECTORVERSION 20221207 ....#define MONOCMD_INITMONO 0..#define MONOCMD_OBJECT_GETCLASS 1..#define MONOCMD_ENUMDOMAINS 2..#define MONOCMD_SETCURRENTDOMAIN 3..#define MONOCMD_ENUMASSEMBLIES 4..#define MONOCMD_GETIMAGEFROMASSEMBLY 5..#define MONOCMD_GETIMAGENAME 6..#define MONOCMD_ENUMCLASSESINIMAGE 7..#define MONOCMD_ENUMFIELDSINCLASS 8..#define MONOCMD_ENUMMETHODSINCLASS 9..#define MONOCMD_COMPILEMETHOD 10....#define MONOCMD_GETMETHODHEADER 11..#define MONOCMD_GETMETHODHEADER_CODE 12..#define MONOCMD_LOOKUPRVA 13..#define MONOCMD_GETJITINFO 14..#define MONOCMD_FINDCLASS 15..#define MONOCMD_FINDMETHOD 16..#define MONOCMD_GETMETHODNAME 17..#define MONOCMD_GETMETHODCLASS 18..#define MONOCMD_GETCLASSNAME 19..#define MONOCMD_GETCLASSNAMESPACE 20..#define MONOCMD_FREEMETHOD 21..#define MONOCMD_TERMINATE 22..#define MONOCMD_DISASSEMBLE 23..#def

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-NO8GF.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4749
                                                                                                                                                                                                                                            Entropy (8bit):5.050824950813426
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:iDz9qCj948ryMvEsMXoQ/O04a0smj9Mn/jMi/Y3SfsdIrmjFFZpmb/RmAdnEm1pd:g5p1O33Bk+QF9jeh9pBdPpFN
                                                                                                                                                                                                                                            MD5:1E571535D8459B8A3FCBA0C9E4871FA4
                                                                                                                                                                                                                                            SHA1:1C0F2CED9985BA808A648C9D95D7DB5076082985
                                                                                                                                                                                                                                            SHA-256:E66368085DB41EF91395CC1212A970117376B5B535E97F291FD71B2277BA9619
                                                                                                                                                                                                                                            SHA-512:3369613A4BDE6B49C73AD70E8DF2EBE7BD1C05FD0D7CBC5E87C5F1F3408FA36F8D7A40C19B097E541A649D7C0F30EE9FDB46B677E926A7A862FA2B794FDC9A80
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview://original source: blob.h in the mono sourcecode....../*.. * Encoding for type signatures used in the Metadata.. */..typedef enum {...MONO_TYPE_END = 0x00, /* End of List */...MONO_TYPE_VOID = 0x01,...MONO_TYPE_BOOLEAN = 0x02,...MONO_TYPE_CHAR = 0x03,...MONO_TYPE_I1 = 0x04,...MONO_TYPE_U1 = 0x05,...MONO_TYPE_I2 = 0x06,...MONO_TYPE_U2 = 0x07,...MONO_TYPE_I4 = 0x08,...MONO_TYPE_U4 = 0x09,...MONO_TYPE_I8 = 0x0a,...MONO_TYPE_U8 = 0x0b,...MONO_TYPE_R4 = 0x0c,...MONO_TYPE_R8 = 0x0d,...MONO_TYPE_STRING = 0x0e,...MONO_TYPE_PTR = 0x0f, /* arg: <type> token */...MONO_TYPE_BYREF = 0x10, /* arg: <type> token */...MONO_TYPE_VALUETYPE = 0x11, /* arg: <type> token */...MONO_TYPE_CLASS = 0x12, /* arg: <type> token */...MONO_TYPE_VAR. = 0x13,. /* number */...MONO_TYPE_ARRAY = 0x14, /* type, rank, boundsCount, bound1, loCount, lo1 */..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-R0Q39.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3498
                                                                                                                                                                                                                                            Entropy (8bit):5.386752810495523
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:ycfIokZotRYYftF1//JlB/R+reZhIxL3HmVZirMiKH8gEIsrdGXCYIr/J+Nn35t1:tAokZotRYYftF1//JlB/R+qZhIxL3Hm1
                                                                                                                                                                                                                                            MD5:35C7C5B4162098879D86CA2D5D7403E7
                                                                                                                                                                                                                                            SHA1:BDB921B2A10398DE218F33EDD4028E2B247F8592
                                                                                                                                                                                                                                            SHA-256:6F971E6E28F95B72775FA0D85922F58FC6BB5B68B34DB72C9D2F69E9374CA09C
                                                                                                                                                                                                                                            SHA-512:70C259E5C01D1EAD0694ADEBAC7639998A2EA3ECB52961B22F74C113669CCD50F80E884EF30D8DEB02028736A06B71F82F3A80EE20121613F8F3049C4D8D2655
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifdef _WINDOWS..#include "stdafx.h"..#elif __linux__..#include "linuxport.h"..#else..#include "macport.h"..#endif....#include "PipeServer.h"........HANDLE DataCollectorThread;..HANDLE SuicideThread;..HINSTANCE g_hInstance;....typedef enum _THREADINFOCLASS {.. ThreadBasicInformation,.. ThreadTimes,.. ThreadPriority,.. ThreadBasePriority,.. ThreadAffinityMask,.. ThreadImpersonationToken,.. ThreadDescriptorTableEntry,.. ThreadEnableAlignmentFaultFixup,.. ThreadEventPair_Reusable,.. ThreadQuerySetWin32StartAddress,.. ThreadZeroTlsCell,.. ThreadPerformanceCount,.. ThreadAmILastThread,.. ThreadIdealProcessor,.. ThreadPriorityBoost,.. ThreadSetTlsArrayAddress, // Obsolete.. ThreadIsIoPending,.. ThreadHideFromDebugger,.. ThreadBreakOnTermination,.. ThreadSwitchLegacyState,.. ThreadIsTerminated,.. ThreadLastSystemCall,.. ThreadIoPriority,.. ThreadCycleTime,.. ThreadPagePriority,.. ThreadActualBasePriority,.. Thr

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-S2D5C.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):71747
                                                                                                                                                                                                                                            Entropy (8bit):5.443198228857467
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:23vsKL5IB9DGdvGgFmk2N8VBFFlIsc8bOJObk:20Kq8VBFNc85k
                                                                                                                                                                                                                                            MD5:6E26B821A5660C3FB1414DBBA46636BF
                                                                                                                                                                                                                                            SHA1:E5AFF92AABB4C902CA2CE617DD2546956648C462
                                                                                                                                                                                                                                            SHA-256:F125B75EE7CAC4F30B9C399B6A371B62A3960E4DB11A64F8937E469B9C2BDD40
                                                                                                                                                                                                                                            SHA-512:647514B0E0537F3018DB7F500FDA81801AB68E02F663892E4D3A3A9A71CBD303A356371C227BBAC3154E883AEFEDDEC699CF40C99B2096E6F993B8B857C2A316
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifdef _WINDOWS..#include "StdAfx.h"..#endif....#ifdef __APPLE__..#include "macport.h"..#endif....#include <setjmp.h>..#ifdef __linux__..#include <signal.h>..#include <sys/types.h>..#include <string.h>..#include <unistd.h>..#include <sys/syscall.h>....#if __GLIBC__ == 2 && __GLIBC_MINOR__ < 30..#define gettid() syscall(SYS_gettid)..#endif....#endif //linux........#include <signal.h>..#include <sys/types.h>....#include "PipeServer.h"........BOOL ExpectingAccessViolations = FALSE;....#ifdef _WINDOWS..#pragma warning( disable : 4101)..HANDLE MDC_ServerPipe = 0;..DWORD ExpectingAccessViolationsThread = 0;..#else..uint64_t ExpectingAccessViolationsThread = 0;..#endif....typedef uint64_t QWORD;......jmp_buf onError;....void ErrorThrow(void)..{...longjmp(onError, 1);..}......#ifdef _WINDOWS......int looper = 0;..LONG NTAPI ErrorFilter(struct _EXCEPTION_POINTERS *ExceptionInfo)..{...if ((ExpectingAccessViolations) && (GetCurrentThreadId() == ExpectingAccessViolationsThread) && (ExceptionInfo->

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\stdafx.cpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):304
                                                                                                                                                                                                                                            Entropy (8bit):4.661406565301994
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jGmyXH+5AMRNT15eAaiErJAhQFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcV:jGXXHJYx5fanrJAKE+yi5JlZ+4cWAoQI
                                                                                                                                                                                                                                            MD5:520DEFE1897C77FCE677BE903979DCA0
                                                                                                                                                                                                                                            SHA1:0EB32160624E8E3B72DF97E440EFCB211A09595C
                                                                                                                                                                                                                                            SHA-256:71E91D8847E8A4E4A757E441B7D785EDDDA95D55FF674E5054D0FDF781773361
                                                                                                                                                                                                                                            SHA-512:337D2893FB92760955D04E788E753B95C835A085929ED4144654899F9A54B96E84A7682A3C7885AA24F98E53FD5B2A2AC03D3F261CD3725F7D15E4422A2942A0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// stdafx.cpp : source file that includes just the standard includes..// MonoDataCollector.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\targetver.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1428
                                                                                                                                                                                                                                            Entropy (8bit):4.639223269334076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
                                                                                                                                                                                                                                            MD5:33F3A8E602AC6644AF839ACB3CA10709
                                                                                                                                                                                                                                            SHA1:0F76681306EBBE5063DA4C93919104D3E0134046
                                                                                                                                                                                                                                            SHA-256:0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
                                                                                                                                                                                                                                            SHA-512:81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\is-O6V9Q.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1351
                                                                                                                                                                                                                                            Entropy (8bit):5.483553389434968
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:pPEkpnjkaUdex0H5p6DK/C868u8o2/b88W:pPTnjY6eqp8bo2/IZ
                                                                                                                                                                                                                                            MD5:9A2A2CADE7D370C563896D2C6F07D1C2
                                                                                                                                                                                                                                            SHA1:E01491AE49454E194C3B4DE2AE668AFEF27B3F3E
                                                                                                                                                                                                                                            SHA-256:287EE21B22308A8B979EB259417503D5B1542BBBF0859EE9344C085DE7866495
                                                                                                                                                                                                                                            SHA-512:CB9337B576030AF522180F16D8B52B36A9CC8099DB19A17D18CE92559C191CA4B61F27BBDA051E895A7E9455033BAB3C52FD057FA52F138F735DCC485F46B546
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.30723.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MonoDataCollector", "MonoDataCollector\MonoDataCollector.vcxproj", "{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Win32 = Debug|Win32....Debug|x64 = Debug|x64....Release|Win32 = Release|Win32....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|Win32.ActiveCfg = Debug|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|Win32.Build.0 = Debug|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|x64.ActiveCfg = Debug|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug|x64.Build.0 = Debug|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Release|Win32.ActiveCfg = Release|Win32....{941726A

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dotnetinfo.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (338), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):84022
                                                                                                                                                                                                                                            Entropy (8bit):4.86677649912196
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:yui2L/B3vpXErHBRpUPrEUvh8VRzXzycAcnNSoaam0WEj:yurB6rhRpUPr9vszjycAcYoaam0WEj
                                                                                                                                                                                                                                            MD5:F30091A31003345EAE2A915D1EE13E9D
                                                                                                                                                                                                                                            SHA1:B42C1B7DA7E620A89A68274C7551D7BB3806441C
                                                                                                                                                                                                                                            SHA-256:CC505DA9EA622E39783D6AC0A98370E1B58EBA6702B9A1796FDC869AEEBBA261
                                                                                                                                                                                                                                            SHA-512:A9A801F42BF9A1ED54CBC2DC7AC397E6695EB685D4F03313059B08DB23ED9055727168B9AFFEE94416A584F703B9B97D515B6BC02FEF99F8EF6FB4B372AEE65E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--dotnetinfo is a passive .net query tool, but it can go to a active state if needed....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetinfo.po')..end....if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep='/'..end....debugInstanceLookup=false....local DPIMultiplier=(getScreenDPI()/96)..local CONTROL_MONO=0..local CONTROL_DOTNET=1....DataSource={} --All collected data about the current process. From domains, to images, to classes, to fields and methods. Saves on queries and multiple windows can use it..local CurrentProcess....local ELEMENT_TYPE_END = 0x00 -- End of List..local ELEMENT_TYPE_VOID = 0x01..local ELEMENT_TYPE_BOOLEAN = 0x02..local ELEMENT_TYPE_CHAR = 0x03..local ELEMENT_TYPE_I1 = 0x04..local ELEMENT_TYPE_U1 = 0x05..local ELEMENT_TYPE_I2 = 0x06..local ELEMENT_TYPE_U2 = 0x07..local ELEMENT_TYPE_I4 = 0x08..local ELEMENT_TYPE_U4 = 0x09..local ELEMENT_TYPE_I8

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dotnetpatch.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7984
                                                                                                                                                                                                                                            Entropy (8bit):4.628436564346363
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:hG6G275/GPinZJGJBo2HXwymhmBEO/66dogk:fG4/vnZJGJv3qABPm
                                                                                                                                                                                                                                            MD5:6BFAA8047A8912C979D8B7ADC21BEFC4
                                                                                                                                                                                                                                            SHA1:9DEB3F151A70B1DE2AF921E2C4A05A9AFBFE88DA
                                                                                                                                                                                                                                            SHA-256:7EFC51C61CEC0EF4330C63E8848AD17BF707CC7067F8F5E195AE69D373BF4D24
                                                                                                                                                                                                                                            SHA-512:BEC70863FE63321EC815164A84FC82F7F03139E668AC165E218B033C2E79150B405AE553CBD8543F3AEDC839DB35FC74C14348E080598FB7BC25FB7908386A0E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--patches a dotnet method. Prerequisite: Must not be inlined or generic, or anything complex....function ParseScriptTokens(script,values).. --parses the script for <> entries and looks up the value in the values table.. if script==nil then .. print(debug.traceback()).. error('ParseScriptTokens: script is nil') .. end.. if values==nil then .. print(debug.traceback()).. error('ParseScriptTokens: values is nil') .. end.. .. return string.gsub(script,"<(.-)>",function(v) .. local r=values[v].. if r then return r else return x end.. end)..end....function dotnetpatch_getAllReferences().. --gets a list of all assemblies.. --todo: if they are in-memory only, export them to a file first (create the mz/pe manually, just the metadata).. local r={}.. local sysfile.... if monopipe then.. mono_enumImages(function(img).. local n=mono_image_get_filename(img).. local ln=extractFileName(n:lower()).. if ln~='mscorlib.dll' and ln~='netstandard.dll' then..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\dotnetsearch.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15160
                                                                                                                                                                                                                                            Entropy (8bit):4.132367012227535
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:fTJbJcJtJZJtJeJAmDF3zY0PLTuHrRthutT9AT0HqkVWAcK3wMexR9WnraIeBXjJ:LJbJcJtJZJtJeJAmDF3zY0jTuHr7huFG
                                                                                                                                                                                                                                            MD5:C5D67D9CB5017F96F34CB9BA0F08FDF0
                                                                                                                                                                                                                                            SHA1:53DCA47CF042380F8DBC3399832A559A2C7368BD
                                                                                                                                                                                                                                            SHA-256:42896BBE75C79C381CC90FBAE685DA24013CAAD0786F1B1A4B569620C45F3F72
                                                                                                                                                                                                                                            SHA-512:C2F41A7C1A25B66B9DC0A496AD87818C9C7E3F70CEB82344AD7F664764293D2F9A43E607A4A299597E44B6763B3BFC63AD8F4EB01C6BD68EAE4BB04ACF775F42
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--dotnetsearch..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetsearch.po')..end....function spawnDotNetSearchDialog(DataSource, frmDotNetInfo, searchtype).... local currentScan --rule: only writable in mainthread.. local searchresults={}.. .. .. --spawns a searchdialog. searchtype has 3 options: 0-ClassName, 1-FieldName, 2-MethodName.. local frmSearch=createFormFromFile(getAutorunPath()..'forms'..pathsep..'DotNetSearch.frm') .. .. _G.frmSearch=frmSearch.. .. if searchtype==0 then.. frmSearch.Caption=translate('Find Class') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current image').. .. frmSearch.cbLimitToCurrentBase.Enabled=frmDotNetInfo.lbImages.ItemIndex>=0 .. frmSearch.lvResults.Columns.delete(2).. elseif searchtype==1 then.. frmSearch.Caption=translate('Find Field') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current class').. frmSearch.cbLimitToCurrentBase.Enabled=f

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\eatme.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):5.052893474705733
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jFwErIVt0OdI+eGvJYazVId2EA3ivun0gVVjec0Lg0zVCAMBNXnGCWMdO:5myTjOId2p3ivIVje5tVDMBRnGV5
                                                                                                                                                                                                                                            MD5:9BA24A4B8CB68B40D229109565572F78
                                                                                                                                                                                                                                            SHA1:F2DABC40C3761FD9196291AB42943D580062CD11
                                                                                                                                                                                                                                            SHA-256:8B5608DAEDB4370990B65579EE8D1D5623644FD9C0BBE007211D5837DC690C72
                                                                                                                                                                                                                                            SHA-512:BEFA54FD6A87BAF24030B6E292E0D8E674FBD69B3424184582EB38D8AF2C8459E7728BC6F03032735A6A1B6C5FE459ECDB1C862BDBD390DC695F4085ABC3918A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Alice says hi!....local t=createTimer()..t.Interval=110000..t.OnTimer=function().. local f=getForm(0).. f.Width=f.Width+2.. f.Height=f.Height+2.... if t.Interval>10000 then.. t.Interval=t.Interval-10000.. end.... createMemoryStream().Size=math.random(65536*4,65536*32);..end

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\forms\DotNetInfo.frm (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1926), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1993
                                                                                                                                                                                                                                            Entropy (8bit):6.43677382842252
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:cmQhOHjryH7ijmpX5ewpjITkwEd0b+huow2zaj5pq:CIrgPX5vdq3/idAq
                                                                                                                                                                                                                                            MD5:14F06EC8B7A351563865937D340EC91C
                                                                                                                                                                                                                                            SHA1:AE85AF607F8958536689E4D2D1266D69F7FAFA68
                                                                                                                                                                                                                                            SHA-256:CD9C88B16FFB21F47D97708AB737E0BFDA712B2DB509A32BEA7AA7AE8DE7098B
                                                                                                                                                                                                                                            SHA-512:BCD1B9BCA9C20C8B4F9144502302A611E7D4C1ED26B9C4A19E3A0A75F1F649B1CD0DE1F5FD4D90512563385AD439720DCE22C4202D80A244AE572EFDEF6C1EED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetInfo Class="TCEForm" Encoding="Ascii85">y.#q08${e{AGUXGCxM1kqPG/i5}]^,l!AIdg4m5yS9W5;CPhdb#:B#C:/LpFckDKmxb=t,_APZZ!}t:skdTmi/HDT[S0p(1ikY2RduP3A=Nn[p?xGn,:6mmb?6DUt,0nE=ueE0lng:Zs]J1E2zfI@7r0rltN+y=(:BGyG4n+S#HQz0n0{]4Yy=hUObYecXHuqhMX0S.D8WC)(?vIB!gm_(l1R,Hvs8n}44h9alw$a2022_R5X4b^=,_,Ftqj4{mKJ4_^/]b;dg}8OS[/k3lpw=-2PGJ.tlh%#hz1?#=[p}{geHf8x+dPz;?v!ZKF@mQ1U$hkTe/lZQXcF@JT6rI^eXI):eC2k7L;]R#A#hPJ-sK_0cuN)Ya6@W%qe;fuQsNuN,_]Nzp!*fT;gSJ_JpjXFZpYBI8grn7V#?L3EPg_.%:H!cKcw)(fQ8+62lPS+@je!jU*VLYYLA4_Fp04p]eN=_HjVvd!(?B;n.67#8sEqI;yNJ]5v(_wBOBl/Ry/fl[/P}NwO1M8YUs/(l?Rl=JMa,Qf+wuYw-BZ/QUMz86+Hg:Fq5wVt}kD;3=c0Sd]R!0fL1p85Jc_8aXBix4^?J?i2KBTc3=236GOX^u5PjNZxT!+tLow_@bR9%ro8OaGYqZDC}gq!Ei;yj?mYz;ysTQd7vzxKYh=}.ISwgUUu%@z4#}}WFVk(Vro7*qKHx5kdTkl!g!SX^Do])2v6m7sP6o_$/9?5W?XS;F,8PfT0V#4?2x3o0f9{$@TH={m;C).e3oFF9qzbuuc@x0ib00SaFlUq=Q}Wc:ihFzIY}t#YR.LI*+ut{A[vZCKRuZ.behF=[tW2kV5O3+o^G{t^Lt*$Sw2XXk78c2@eb0,v97^OAX[/HBQ-G(Z$-Jg)S@92.e%43)1

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\forms\DotNetSearch.frm (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (929), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):996
                                                                                                                                                                                                                                            Entropy (8bit):6.420065473502429
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dxxNUQ7V0EdLp1H9DTFhJMSqL3bi3LMo7CTNzErduIkjbnw:c/+QdLbHpTB5w3bUApe47bw
                                                                                                                                                                                                                                            MD5:C884C42A2BA59904C39D9825F0A5FFAF
                                                                                                                                                                                                                                            SHA1:D18E6CEEEC9D9CB6562E006EF6112C528E814D24
                                                                                                                                                                                                                                            SHA-256:A74C6BB9A778F806577A2528BCACD3E9CB0BD5CAAEF5D92C2B1ADF101BB9E57D
                                                                                                                                                                                                                                            SHA-512:23C2368BBCF228B536DBE64FFC5FEF8E0D87D3D65B7BB9CD25369D9A727C8F2B04754B4A3404F31CD14B4D0C6A2AC6492D0CBCB66CB5A0E2B056C42D39BF9F51
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetSearch Class="TCEForm" Encoding="Ascii85">rIgQd):ZUm6{gG,wv$rY.mC+=4s8!D?B{2Lp]8hBhy$Dzdz*ygNFG@E8:it!.T3om=i=6}E0XOvIFkc@E_DY4yT9,-*#4UHqe1VPI__NwQqA@m*a.eiSD-[nDw:Nf.YK=ToYn:f$y7V9u]]m1@9=mWuvkx;pV$p)qL}z{$Hf:q@y,+;0#4KPtjB:IXKz4HWxN{320}YHc8dSYFy26;%+Jusi3{qJAOiCm6xuOpeU_F=4DNhBA3}aOo#tQ_FS%$V:lZ)j]i]3((L,b3C?(HncBP6zg$a$An4ET$%tVY0zU0_Vr0s@,$,QgFNAN32(C3}]KoJs.)Z)aW)):f:jYoD10{3{vzRw6DZwNHL7JT9RLwOehhe-S0h;ou/D0Y0SIMfRct}XDIkVvHwvXwfInQlW_+630snXdbRkE_V-th;;q-0VNBTTy(?P}RNpVekqEd4?35RB4QS@VkP5F[O^#2:4U-6S@mbHfBoYx*JYk8r^{j6,(7!X./;th[[XxW8hx7K3]Knas_tJ^]dn0mEp%[C%)-/Eyz)nqa;l*@pYTHM9oi?ST7,y-WgB?CAPN#;cu7}:gZ$v=bkQ0D6b-Q%Whuduq[]/A-e6#]?=A5XEUZpGRTxY*TJq]VLi;gy7:#ES6ol;ltfDs6-h}c6VCExC)]unsxcacZv!fF-{1FACRzfX/i34cO@q7i;dtI.VGjH^GqrMC/N1^oP?5b0WPNN?7@W*=MK^yh%#g7bp^ewvj*/mGg*9cka}haFRFb/D:E2$l]^4RCRmJQnrr+m)O}$e)?qEKw-zJ3E%x3xR;Y#c[[o8uNiWq^hBX7RBn+3inzis1@DzKYpgxGJIi;r,=lepMf!EG71Uj</frmDotNetSearch>..</FormData>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\forms\MonoDataCollector.frm (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1475), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1542
                                                                                                                                                                                                                                            Entropy (8bit):6.413889728128656
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dl+Q7dIn/BzGXaMSRuVQn3b/Go2DG0E2Gy6UylxJvaKoj+RSGrsuwdKiVrcfBkd:cwQq/BzGXkL/b2TOXNPSich4C/8/Tm
                                                                                                                                                                                                                                            MD5:03D4DD46084BCBE16A39D72BA22E5446
                                                                                                                                                                                                                                            SHA1:BA414E6BA6CD5503BABA82A7A96272D850CB9CD1
                                                                                                                                                                                                                                            SHA-256:4F254BBC897AD0E165986D18577E0A04FD31C93CCA542A0999FA0093EDC5BC61
                                                                                                                                                                                                                                            SHA-512:B37CF277443F3D4D9C8207E17EF146FABE003402750F812C27369210C79E43BAF45FB49AC2B370D2B1B1077912C9B9A9EA4AA4F7D5166B9FA1A152384902E19D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <monoForm_1_1 Class="TCEForm" Encoding="Ascii85">eO6mj/2DpF2@.4Ig;G5sOfPPy=X+mXmX_)uN{bTn76[BLz#F5rPl$;vd1M9HnSJaJYyVkwEL%3%=2}nF-#Pwtbfh-{#_h4le_7[Zd?N*/j0G3CxIVl-Tt9)?YX7s:c?6YtsoKA,wF8l}_8rhk)nu{amo3+PiK2pcHcxe(7tu6?PzgEo83nHLxUbg,MlQnEPl2!8-YKCRSBKqmky6BQHxn?rB;=xeJ4p9{rt}d=-quK+2^k8oFyR3}jWf[C2io/H!hI^a$ck,[9h)ztZIz_IIAZjMyIsOeE!!hlkQGxC1,j?}ecU?2$tuZ.;*YjFcLpSya]vv+n}D25F#U[YuC8J#Bakg.IOV:zj3g:LH_^nvcpY4ns:/[x9{;bNG.ihRQZvmMOb6TQP8[Y2C:1%sn%6V{lTthFXvLoZNsbNCnTQ{AXl,sA5Z6VKn[8GJ#r@LqrF4d2E{l=sf;4,Vp;Q1t!2,738?OIV4ADrEd(hD5fn{n=i96,*.O@o7EU.lhp=B.-T==L_#pwm.iGSn9bOwJ?WxJ+QMhluXM#Eco$0FozncAtuZ@m?O?5C+ff=A5m!t9J6AY3W/$ymMEm/!.}D!_qF8vY:re{I}t[=k?%KF{({a@hvm0]k*eqz$Rzy@JYRJ2?HAl.^%=zh(/%=n@WwaMf7ge@tS,LDcfRis;:s)S*ap?DS4J!e]pqrrJfTM,;tj7G9V,j5!^msB80nS.@Z3S/Si}Q^B8ms:1P?P[1Oi,2*8S.#qwqXfLKCGaTlMC;qvdKhN!DxMy5F1htiZSE.lav8jEIqNtv6yOy!Bb+iy7=A@!qneIoK)z[4-mUXIZ^I_}{w7z-fO6nnQ6_gAH:2eleV^^EAB1xH1OA.z:vZoaV+O]M=csyI)Q;:P+J2CYo5CvKP6#

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\forms\is-89VU3.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1926), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1993
                                                                                                                                                                                                                                            Entropy (8bit):6.43677382842252
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:cmQhOHjryH7ijmpX5ewpjITkwEd0b+huow2zaj5pq:CIrgPX5vdq3/idAq
                                                                                                                                                                                                                                            MD5:14F06EC8B7A351563865937D340EC91C
                                                                                                                                                                                                                                            SHA1:AE85AF607F8958536689E4D2D1266D69F7FAFA68
                                                                                                                                                                                                                                            SHA-256:CD9C88B16FFB21F47D97708AB737E0BFDA712B2DB509A32BEA7AA7AE8DE7098B
                                                                                                                                                                                                                                            SHA-512:BCD1B9BCA9C20C8B4F9144502302A611E7D4C1ED26B9C4A19E3A0A75F1F649B1CD0DE1F5FD4D90512563385AD439720DCE22C4202D80A244AE572EFDEF6C1EED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetInfo Class="TCEForm" Encoding="Ascii85">y.#q08${e{AGUXGCxM1kqPG/i5}]^,l!AIdg4m5yS9W5;CPhdb#:B#C:/LpFckDKmxb=t,_APZZ!}t:skdTmi/HDT[S0p(1ikY2RduP3A=Nn[p?xGn,:6mmb?6DUt,0nE=ueE0lng:Zs]J1E2zfI@7r0rltN+y=(:BGyG4n+S#HQz0n0{]4Yy=hUObYecXHuqhMX0S.D8WC)(?vIB!gm_(l1R,Hvs8n}44h9alw$a2022_R5X4b^=,_,Ftqj4{mKJ4_^/]b;dg}8OS[/k3lpw=-2PGJ.tlh%#hz1?#=[p}{geHf8x+dPz;?v!ZKF@mQ1U$hkTe/lZQXcF@JT6rI^eXI):eC2k7L;]R#A#hPJ-sK_0cuN)Ya6@W%qe;fuQsNuN,_]Nzp!*fT;gSJ_JpjXFZpYBI8grn7V#?L3EPg_.%:H!cKcw)(fQ8+62lPS+@je!jU*VLYYLA4_Fp04p]eN=_HjVvd!(?B;n.67#8sEqI;yNJ]5v(_wBOBl/Ry/fl[/P}NwO1M8YUs/(l?Rl=JMa,Qf+wuYw-BZ/QUMz86+Hg:Fq5wVt}kD;3=c0Sd]R!0fL1p85Jc_8aXBix4^?J?i2KBTc3=236GOX^u5PjNZxT!+tLow_@bR9%ro8OaGYqZDC}gq!Ei;yj?mYz;ysTQd7vzxKYh=}.ISwgUUu%@z4#}}WFVk(Vro7*qKHx5kdTkl!g!SX^Do])2v6m7sP6o_$/9?5W?XS;F,8PfT0V#4?2x3o0f9{$@TH={m;C).e3oFF9qzbuuc@x0ib00SaFlUq=Q}Wc:ihFzIY}t#YR.LI*+ut{A[vZCKRuZ.behF=[tW2kV5O3+o^G{t^Lt*$Sw2XXk78c2@eb0,v97^OAX[/HBQ-G(Z$-Jg)S@92.e%43)1

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\forms\is-FFQ95.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (1475), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1542
                                                                                                                                                                                                                                            Entropy (8bit):6.413889728128656
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dl+Q7dIn/BzGXaMSRuVQn3b/Go2DG0E2Gy6UylxJvaKoj+RSGrsuwdKiVrcfBkd:cwQq/BzGXkL/b2TOXNPSich4C/8/Tm
                                                                                                                                                                                                                                            MD5:03D4DD46084BCBE16A39D72BA22E5446
                                                                                                                                                                                                                                            SHA1:BA414E6BA6CD5503BABA82A7A96272D850CB9CD1
                                                                                                                                                                                                                                            SHA-256:4F254BBC897AD0E165986D18577E0A04FD31C93CCA542A0999FA0093EDC5BC61
                                                                                                                                                                                                                                            SHA-512:B37CF277443F3D4D9C8207E17EF146FABE003402750F812C27369210C79E43BAF45FB49AC2B370D2B1B1077912C9B9A9EA4AA4F7D5166B9FA1A152384902E19D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <monoForm_1_1 Class="TCEForm" Encoding="Ascii85">eO6mj/2DpF2@.4Ig;G5sOfPPy=X+mXmX_)uN{bTn76[BLz#F5rPl$;vd1M9HnSJaJYyVkwEL%3%=2}nF-#Pwtbfh-{#_h4le_7[Zd?N*/j0G3CxIVl-Tt9)?YX7s:c?6YtsoKA,wF8l}_8rhk)nu{amo3+PiK2pcHcxe(7tu6?PzgEo83nHLxUbg,MlQnEPl2!8-YKCRSBKqmky6BQHxn?rB;=xeJ4p9{rt}d=-quK+2^k8oFyR3}jWf[C2io/H!hI^a$ck,[9h)ztZIz_IIAZjMyIsOeE!!hlkQGxC1,j?}ecU?2$tuZ.;*YjFcLpSya]vv+n}D25F#U[YuC8J#Bakg.IOV:zj3g:LH_^nvcpY4ns:/[x9{;bNG.ihRQZvmMOb6TQP8[Y2C:1%sn%6V{lTthFXvLoZNsbNCnTQ{AXl,sA5Z6VKn[8GJ#r@LqrF4d2E{l=sf;4,Vp;Q1t!2,738?OIV4ADrEd(hD5fn{n=i96,*.O@o7EU.lhp=B.-T==L_#pwm.iGSn9bOwJ?WxJ+QMhluXM#Eco$0FozncAtuZ@m?O?5C+ff=A5m!t9J6AY3W/$ymMEm/!.}D!_qF8vY:re{I}t[=k?%KF{({a@hvm0]k*eqz$Rzy@JYRJ2?HAl.^%=zh(/%=n@WwaMf7ge@tS,LDcfRis;:s)S*ap?DS4J!e]pqrrJfTM,;tj7G9V,j5!^msB80nS.@Z3S/Si}Q^B8ms:1P?P[1Oi,2*8S.#qwqXfLKCGaTlMC;qvdKhN!DxMy5F1htiZSE.lav8jEIqNtv6yOy!Bb+iy7=A@!qneIoK)z[4-mUXIZ^I_}{w7z-fO6nnQ6_gAH:2eleV^^EAB1xH1OA.z:vZoaV+O]M=csyI)Q;:P+J2CYo5CvKP6#

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\forms\is-UTFRU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (929), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):996
                                                                                                                                                                                                                                            Entropy (8bit):6.420065473502429
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2dxxNUQ7V0EdLp1H9DTFhJMSqL3bi3LMo7CTNzErduIkjbnw:c/+QdLbHpTB5w3bUApe47bw
                                                                                                                                                                                                                                            MD5:C884C42A2BA59904C39D9825F0A5FFAF
                                                                                                                                                                                                                                            SHA1:D18E6CEEEC9D9CB6562E006EF6112C528E814D24
                                                                                                                                                                                                                                            SHA-256:A74C6BB9A778F806577A2528BCACD3E9CB0BD5CAAEF5D92C2B1ADF101BB9E57D
                                                                                                                                                                                                                                            SHA-512:23C2368BBCF228B536DBE64FFC5FEF8E0D87D3D65B7BB9CD25369D9A727C8F2B04754B4A3404F31CD14B4D0C6A2AC6492D0CBCB66CB5A0E2B056C42D39BF9F51
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetSearch Class="TCEForm" Encoding="Ascii85">rIgQd):ZUm6{gG,wv$rY.mC+=4s8!D?B{2Lp]8hBhy$Dzdz*ygNFG@E8:it!.T3om=i=6}E0XOvIFkc@E_DY4yT9,-*#4UHqe1VPI__NwQqA@m*a.eiSD-[nDw:Nf.YK=ToYn:f$y7V9u]]m1@9=mWuvkx;pV$p)qL}z{$Hf:q@y,+;0#4KPtjB:IXKz4HWxN{320}YHc8dSYFy26;%+Jusi3{qJAOiCm6xuOpeU_F=4DNhBA3}aOo#tQ_FS%$V:lZ)j]i]3((L,b3C?(HncBP6zg$a$An4ET$%tVY0zU0_Vr0s@,$,QgFNAN32(C3}]KoJs.)Z)aW)):f:jYoD10{3{vzRw6DZwNHL7JT9RLwOehhe-S0h;ou/D0Y0SIMfRct}XDIkVvHwvXwfInQlW_+630snXdbRkE_V-th;;q-0VNBTTy(?P}RNpVekqEd4?35RB4QS@VkP5F[O^#2:4U-6S@mbHfBoYx*JYk8r^{j6,(7!X./;th[[XxW8hx7K3]Knas_tJ^]dn0mEp%[C%)-/Eyz)nqa;l*@pYTHM9oi?ST7,y-WgB?CAPN#;cu7}:gZ$v=bkQ0D6b-Q%Whuduq[]/A-e6#]?=A5XEUZpGRTxY*TJq]VLi;gy7:#ES6ol;ltfDs6-h}c6VCExC)]unsxcacZv!fF-{1FACRzfX/i34cO@q7i;dtI.VGjH^GqrMC/N1^oP?5b0WPNN?7@W*=MK^yh%#g7bp^ewvj*/mGg*9cka}haFRFb/D:E2$l]^4RCRmJQnrr+m)O}$e)?qEKw-zJ3E%x3xR;Y#c[[o8uNiWq^hBX7RBn+3inzis1@DzKYpgxGJIi;r,=lepMf!EG71Uj</frmDotNetSearch>..</FormData>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\images\export128x128.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1498
                                                                                                                                                                                                                                            Entropy (8bit):7.563086239733145
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2sH8UyMTD18ODCZk7X4zJz2pAlNrpAmvnFtljgCie8pYiOZqfE9St7Bq:2sH83sok7X+gAlBVZjzi7pYi8VKc
                                                                                                                                                                                                                                            MD5:A9BCD80603FBCF041BC462918CA48A64
                                                                                                                                                                                                                                            SHA1:A7908250F042B3454D8DDCB5CB20E569839BE135
                                                                                                                                                                                                                                            SHA-256:3E671AC6A8E77F11B4C6547CF810BC06327E84961C7657340F5CA0F622A966D9
                                                                                                                                                                                                                                            SHA-512:CE82C8CAABA0329656C26EFD5F7C86A0B35A161856B975C9918FD1CD503B32B133D6F0B01DAFB92AAE132DD4C19F23C7349BF146123554700E05AA94320FC0AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............>a.....pHYs...........~.....IDATx..Qh[U......%.cX.<.7..B..}.9[..A..N..'..Z|\.E...M|..d*.U...V.x...Yl..K..GN..5...9....BK..9..q.w.9GH)..%.....0..Y....o...R..cj...9.....7F....*.....LDi).mZ.[.077..:.A.T.l6K.r..2mZ;Z.....S(.hdd.....2.Y5..O..`xx........!...=..d2.ZXXp.RcBFJ.hB.!...| .J....%(.^w..>.H$......Q..C..P.......g...u.7...Q......:....gT>.N.iee.)X%.)]....>....x.)X...41........X.:'..r..C@....|>...... @..|@=.,--9...........]'......!..v...I"m.....t^4...At\4.......vR.|.C@.i.h.......0.-.a...M...K);.:>z.........3.....*.PS....0..0..0..0..0..0..0..0..0..h.."#.H.];../....AK..tFn.z..}....@c.?q....'.CG..J...9...S.?.z....)....7A.W>........][.`...=..?..........D..@...[..` ~J...EI.....V.X...m..0..iz.....\.....i..0.%..k_X...7c.K^[..B.#Ac..W...`bbB-..{MNN..sU}%...^..~%hzd.I.\.J.?=az3|..`....j..o.*.C@....@...E...R....................}."....!..g..B.....7b...I.............0....O..o(..(v..%%.....A....9..c..g.6....QZ,8..s.(..LX_]._.{

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\images\import128x128.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1169
                                                                                                                                                                                                                                            Entropy (8bit):7.406441361590178
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:RjlRKcz+Q1mlGwDxsQMod1x2W3QL9IR/RBTz:1lRK8sNDwobx2WgBIljTz
                                                                                                                                                                                                                                            MD5:660D8ACF876EAD3B985F9DF515160838
                                                                                                                                                                                                                                            SHA1:78A858326C16FA917C4A5284A606B824F025AF00
                                                                                                                                                                                                                                            SHA-256:4923FBF164D8DC0111E28DC1864BAC8CA2503FEE2B7A688845B4616465529EE6
                                                                                                                                                                                                                                            SHA-512:81BFF98BCE7CC6EE066FE8E1AB1FA957E56C62084A33D879A87CA22AFDF6D88012F1ECDF5DCF2493D816B96DD08073782F31F36DA9BCA37C53FC81CCFAB1E17A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............>a.....pHYs...........~....CIDATx..MHTQ......i.".)W.A.`.B...jc.i.. .h..2.ha.J7E..jm...........M.Q.g<.SC...s.y....:s.7.}...s........cC........7O..HI.M..R....F9.....c;n..t....k.).F.HP{.....U........P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8......3?.o...w.Q...Uq..... "q...m9 .-..........B^.:....W}8""N.`.....A.../......7...N.J*.......tum....+u9u............./....&...W..H.z...e............./>t.eK.0.......K..KO`F././.......Fk..}._|.......{=1r.I..&.Mk.%|q.#h;.c.WE..<.m.;Q....q_r}m....T... ..tVE.. AV....].x9......._......... ......*%A(.K.7..[...P..*..../.^.lE....h..~Q.==zSf_?.*|.M..`wwo.=^..Ab8....../!. ..........v*.......J.....zW..eS.C..^Nk.....u.B._B..d0.4.4.N5.>..wO..?.4{.Z.P.:+I...48.0.=.J..01$_......A..-|A...?.|...3`.......sf.....s.Z.sc.F.5..S.....C.>.mg.e........y1...[N.+..\![..w:cZ...w..~6...,...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\images\is-1DU32.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1498
                                                                                                                                                                                                                                            Entropy (8bit):7.563086239733145
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:2sH8UyMTD18ODCZk7X4zJz2pAlNrpAmvnFtljgCie8pYiOZqfE9St7Bq:2sH83sok7X+gAlBVZjzi7pYi8VKc
                                                                                                                                                                                                                                            MD5:A9BCD80603FBCF041BC462918CA48A64
                                                                                                                                                                                                                                            SHA1:A7908250F042B3454D8DDCB5CB20E569839BE135
                                                                                                                                                                                                                                            SHA-256:3E671AC6A8E77F11B4C6547CF810BC06327E84961C7657340F5CA0F622A966D9
                                                                                                                                                                                                                                            SHA-512:CE82C8CAABA0329656C26EFD5F7C86A0B35A161856B975C9918FD1CD503B32B133D6F0B01DAFB92AAE132DD4C19F23C7349BF146123554700E05AA94320FC0AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............>a.....pHYs...........~.....IDATx..Qh[U......%.cX.<.7..B..}.9[..A..N..'..Z|\.E...M|..d*.U...V.x...Yl..K..GN..5...9....BK..9..q.w.9GH)..%.....0..Y....o...R..cj...9.....7F....*.....LDi).mZ.[.077..:.A.T.l6K.r..2mZ;Z.....S(.hdd.....2.Y5..O..`xx........!...=..d2.ZXXp.RcBFJ.hB.!...| .J....%(.^w..>.H$......Q..C..P.......g...u.7...Q......:....gT>.N.iee.)X%.)]....>....x.)X...41........X.:'..r..C@....|>...... @..|@=.,--9...........]'......!..v...I"m.....t^4...At\4.......vR.|.C@.i.h.......0.-.a...M...K);.:>z.........3.....*.PS....0..0..0..0..0..0..0..0..0..h.."#.H.];../....AK..tFn.z..}....@c.?q....'.CG..J...9...S.?.z....)....7A.W>........][.`...=..?..........D..@...[..` ~J...EI.....V.X...m..0..iz.....\.....i..0.%..k_X...7c.K^[..B.#Ac..W...`bbB-..{MNN..sU}%...^..~%hzd.I.\.J.?=az3|..`....j..o.*.C@....@...E...R....................}."....!..g..B.....7b...I.............0....O..o(..(v..%%.....A....9..c..g.6....QZ,8..s.(..LX_]._.{

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\images\is-3VEHV.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1169
                                                                                                                                                                                                                                            Entropy (8bit):7.406441361590178
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:RjlRKcz+Q1mlGwDxsQMod1x2W3QL9IR/RBTz:1lRK8sNDwobx2WgBIljTz
                                                                                                                                                                                                                                            MD5:660D8ACF876EAD3B985F9DF515160838
                                                                                                                                                                                                                                            SHA1:78A858326C16FA917C4A5284A606B824F025AF00
                                                                                                                                                                                                                                            SHA-256:4923FBF164D8DC0111E28DC1864BAC8CA2503FEE2B7A688845B4616465529EE6
                                                                                                                                                                                                                                            SHA-512:81BFF98BCE7CC6EE066FE8E1AB1FA957E56C62084A33D879A87CA22AFDF6D88012F1ECDF5DCF2493D816B96DD08073782F31F36DA9BCA37C53FC81CCFAB1E17A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............>a.....pHYs...........~....CIDATx..MHTQ......i.".)W.A.`.B...jc.i.. .h..2.ha.J7E..jm...........M.Q.g<.SC...s.y....:s.7.}...s........cC........7O..HI.M..R....F9.....c;n..t....k.).F.HP{.....U........P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8......3?.o...w.Q...Uq..... "q...m9 .-..........B^.:....W}8""N.`.....A.../......7...N.J*.......tum....+u9u............./....&...W..H.z...e............./>t.eK.0.......K..KO`F././.......Fk..}._|.......{=1r.I..&.Mk.%|q.#h;.c.WE..<.m.;Q....q_r}m....T... ..tVE.. AV....].x9......._......... ......*%A(.K.7..[...P..*..../.^.lE....h..~Q.==zSf_?.*|.M..`wwo.=^..Ab8....../!. ..........v*.......J.....zW..eS.C..^Nk.....u.B._B..d0.4.4.N5.>..wO..?.4{.Z.P.:+I...48.0.=.J..01$_......A..-|A...?.|...3`.......sf.....s.Z.sc.F.5..S.....C.>.mg.e........y1...[N.+..\![..w:cZ...w..~6...,...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-2D45H.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2095
                                                                                                                                                                                                                                            Entropy (8bit):4.920154640424097
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:gzax3OK42b8w6aBxVpKDRKLYChKr+deaUAyA16AhXaAe76:gzax+KIPazVpKDRaNhKr+dlUDy6GXapW
                                                                                                                                                                                                                                            MD5:CA347DEF8A682D2ADF951C4ECBABD948
                                                                                                                                                                                                                                            SHA1:C65BBC8A5106E9ACE9DDC450EC3A5F637704FA62
                                                                                                                                                                                                                                            SHA-256:1F11078B143B92612822F3DFC09D93778471198F203694C8FC911E249FBBC557
                                                                                                                                                                                                                                            SHA-512:9F7A08822D9357AF72A27707C17FC0D3EC03E72333D88E2BA8E2BE95EAB7BA9C1B33EA3E2E20D734C382F4732F77443D3AA9C189667A74195987F5DB486E2651
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local c=createComboBox(MainForm.gbScanOptions)....c.Style='csDropDownList'..c.Items.add('All')..c.ItemIndex=0..c.Name='ScanOptionsModuleList' ......c.Align=alTop..c.BorderSpacing.Left=6..c.BorderSpacing.Right=6..c.BorderSpacing.Bottom=2....local modulelist....function FillList().. local is64bit=targetIs64Bit().. local op.. if is64bit then.. op='32'.. else.. op='64'.. end.. synchronize(function() .. while c.Items.Count>1 do.. c.Items.delete(1).. end.. end).... modulelist=enumModules().. .. synchronize(function().. if modulelist then.. local i.. for i=1, #modulelist do.. modulelist[i].OriginalName=modulelist[i].Name.. if modulelist[i].Is64Bit ~= is64bit then.. modulelist[i].OriginalName='_'..modulelist[i].OriginalName.. modulelist[i].Name=modulelist[i].Name..' ('..op..'-bit)'.. end.... c.Items.Add(modulelist[i].Name).. end.. end.. end)..end....c.OnMouseEnter=function(d) .. if c.Items.Count<

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-5NNAH.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20837
                                                                                                                                                                                                                                            Entropy (8bit):4.996731854830045
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Rmi4uQRgQgAgm2+CXgSKgKghmg60gGg4tgKplg/Dhrf+1e5l7jTRgzKgIgmoJMQZ:y3KQBHvSo9a452TZ0YgkP
                                                                                                                                                                                                                                            MD5:04CDE30D6AA9999A846B5FC3CFC1F56C
                                                                                                                                                                                                                                            SHA1:2187AB73161EE8A516D25F8295BB4C7E3DA2F7E3
                                                                                                                                                                                                                                            SHA-256:EAE2A91808BB58B386F3BDDE75176C7208C22BF5515C5D6E467C583DF2E72E15
                                                                                                                                                                                                                                            SHA-512:FB2F27F3981E587DDD379D54999067092DC2FBE2F243E4A49B2F9D4DA172907D169BC708AA0840631C951FB01CCB9E69A403EB2E19A5F1AFF1BE3FF0EEC27C62
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview: ..--same as monodatacollector but for .net and .netcore..--can theoretically be used on mono as well....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetforceddatacollector.po')..end......local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....dotnet_timeout=3000....DOTNETCMD_TEST=0..DOTNETCMD_INITMODULELIST=1..DOTNETCMD_GETMETHODENTRYPOINT=2..DOTNETCMD_GETFIELDTYPENAME=3..DOTNETCMD_GETFIELDVALUE=4..DOTNETCMD_SETFIELDVALUE=5..DOTNETCMD_LOADMODULE=6..DOTNETCMD_GETMETHODPARAMETERS=7..DOTNETCMD_WRAPOBJECT=8..DOTNETCMD_UNWRAPOBJECT=9..DOTNETCMD_INVOKEMETHOD=10....DOTNETCMD_FIND_MODULEID_WITH_CLASSLIST=11......DOTNETCMD_EXIT=255......dotnetmodulelist={}....function dotnet_findDotNetMethodAddress(namespace, classname, methodname, modulename).. --print(string.format("dotnet_findDotNetMethodAddress('%s','%s','%s','%s')",namespace,classname, methodname, modulenam

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-6TLNO.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (312), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64056
                                                                                                                                                                                                                                            Entropy (8bit):5.143902164750308
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:/ilZhlpsM/bJ+CGLM0oJyevomQ385GxwuyC+N/0nNjoHhjCL:/ilZhlpsM6M0oJyUomQMUyC+N/0ZoCL
                                                                                                                                                                                                                                            MD5:54151E1842473981D08C4B1B69CEB46C
                                                                                                                                                                                                                                            SHA1:26CCFFD2AD4DE7FEA9CA7B11FBFBCF5CA3E9EA00
                                                                                                                                                                                                                                            SHA-256:B318D2AC5CF96BA8A0A36EDDBB62B250004D44F214BB10C0E82E4F2DDBDA95D9
                                                                                                                                                                                                                                            SHA-512:F9B76F51F089807610052D1DA2F147975EA3A2FF00C70FC373087A9CE55E24337F52174F062D5EC262FF9227F98CB32E09753B4E5A68FB443D8EB27890607B73
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--todo: split up into multiple units and use the java table for the methods as well......JAVACMD_STARTCODECALLBACKS=0..JAVACMD_STOPCODECALLBACKS=1..JAVACMD_GETLOADEDCLASSES=2..JAVACMD_DEREFERENCELOCALOBJECT=3..JAVACMD_GETCLASSMETHODS=4..JAVACMD_GETCLASSFIELDS=5..JAVACMD_GETIMPLEMENTEDINTERFACES=6..JAVAVMD_FINDREFERENCESTOOBJECT=7..JAVACMD_FINDJOBJECT=8..JAVACMD_GETCLASSSIGNATURE=9 --=getClassName..JAVACMD_GETSUPERCLASS=10..JAVACMD_GETOBJECTCLASS=11..JAVACMD_GETCLASSDATA=12..JAVACMD_REDEFINECLASS=13..JAVACMD_FINDCLASS=14..JAVACMD_GETCAPABILITIES=15..JAVACMD_GETMETHODNAME=16 --gets the methodname and the signature..JAVACMD_INVOKEMETHOD=17..JAVACMD_FINDCLASSOBJECTS=18 --find objects that belong to the given class..JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH=19..JAVACMD_ADDTOSYSTEMCLASSLOADERPATH=20..JAVACMD_PUSHLOCALFRAME=21..JAVACMD_POPLOCALFRAME=22..JAVACMD_GETFIELDDECLARINGCLASS=23..JAVACMD_GETFIELDS

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-78908.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):629
                                                                                                                                                                                                                                            Entropy (8bit):4.667259230622991
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:03Iw9kSSIEPchubhxoyPJ4y/oJf3DftSg0n/iyHfHHEo44JsITT+wF:03IwRCfPJ1/wKrHfHh4AsATvF
                                                                                                                                                                                                                                            MD5:DF4D243AB0407A1F03CCF448232FCF62
                                                                                                                                                                                                                                            SHA1:62453CFA7ABF6FA83158BE1BA86C854D9A6B7D4B
                                                                                                                                                                                                                                            SHA-256:C5A35380AF8BEBE96B85377F5F41F8C068CB857C74B9CB85B7467B35C1DE10C4
                                                                                                                                                                                                                                            SHA-512:4B05B65909673E92F59AB64C1FF4E0B829F5C9085EAFA1FFF28CB0CCD7E6A7F6EF031633F443E0BA156A4B8F5009F526D0356F39EF77B22706F98F100B1909C2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:luasymbols=registerSymbolLookupCallback(function(str).. if str then.. local firstchar=str:sub(1,1).. .. if (firstchar=='\'') or (firstchar=='\"') then.. return nil.. end.. .. local c='return '..str.. local lc=loadstring(c).. if lc then.. local isvalid,result=pcall(lc).. if isvalid then.. return result.. else.. return nil.. end.. end.. end..end, slNotSymbol) ....registerEXETrainerFeature('Lua Symbols', function().. local r={}.. r[1]={}.. r[1].PathToFile=getCheatEngineDir()..[[autorun\luasymbols.lua]].. r[1].RelativePath=[[autorun\]].. .. return r..end)

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-A7KQL.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17557
                                                                                                                                                                                                                                            Entropy (8bit):4.7553596901580395
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:02/2WiurcwWJsFH1bukLWmHwt/5B9ndDiC4fVAslnlKQ8gLIeHkSD//TVxVkB8CZ:HtWIBugO8ieHkSDnTVTnC8i+lLQC/6
                                                                                                                                                                                                                                            MD5:F2896031568F43A7E4A7529A16F4EA12
                                                                                                                                                                                                                                            SHA1:A24B17AEC47FB290EE29BFC01C7386B85827D14E
                                                                                                                                                                                                                                            SHA-256:0714BD0F908345D7588A09C856746D76861CE4EB3571692BABC1BCE2D35A57AA
                                                                                                                                                                                                                                            SHA-512:B4F9EBB1E8375045269FF11FE2B6AEC3C31E64AB89CDDBFF1D26451DB3426AE841E28D184539959F84248CF101854F47E8F3497BA8414460ABCAC3C0D66248B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local DPIMultiplier=(getScreenDPI()/96)....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'patchscan.po')..end....local IMAGE_SCN_CNT_CODE=0x20..local IMAGE_SCN_MEM_EXECUTE=0x20000000....function byteTableToHexString(bt).. local i.. local r=''.... if bt then.. for i=1,#bt do.. r=r..string.format("%.2x ",bt[i]).. end.. end.. return r..end......function scanModuleForPatches(modulepath, loadedModuleBase, thread).... local original=createMemoryStream().. local r,e=original.loadFromFileNoError(modulepath).. if not r then.. original.destroy().. return false,e.. end.. original.Position=0...... if (byteTableToString(original.read(2))~='MZ') then.. original.destroy().. return nil,translate('Not a valid executable').. end.... original.Position=60;.. local lfanew=original.readDword();.. original.Position=lfanew;.... if (byteTableToString(original.read(2))~='PE') then.. original.destroy().. return nil,translate('Not a valid win

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-ANDBM.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8088
                                                                                                                                                                                                                                            Entropy (8bit):5.172167677485522
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:zuiTTPEYya1gq5jfFEYQhRIA03xB97cq1fvhEN:ztTzyapKRiG
                                                                                                                                                                                                                                            MD5:B5AE011C70C1D26CC31A5D818D60E53C
                                                                                                                                                                                                                                            SHA1:7BE6AD86FCC9208D6F21B9F1D464B6334E64922B
                                                                                                                                                                                                                                            SHA-256:31ED4209776DBFAD74EC811326439D26C02B6AB653056D5E171D952C12D3F25B
                                                                                                                                                                                                                                            SHA-512:440B1AFC72D671D8AA663B6672371AC365029525EE055CF380A9C9C84625FD5FA2B328110633A183F87CECF8D1D2CACB62E49A7EB382B30AAA75DA5B3D2F3054
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--[[..You have a d:\bla.dll with namespace ClassLibraryX, with a class named "MyClass"..That class contains a function defined as:..public static int MyInitFunctionName(string parameters)....then you do: injectDotNetDLL('d:\\bla.dll','ClassLibraryX.MyClass','MyInitFunctionName','Something')....--]]....local DotNetCoreInjectScript=[[..[enable]..alloc(injectdotnetdll, 2048)..alloc(IID_ICLRRuntimeHost4,16)..alloc(RuntimeHost,8)....alloc(paramstr,256)..alloc(methodname,256)..alloc(classname,256)..alloc(dllpath,512)....alloc(returnvalue,4)..alloc(errorvalue,4)..label(error)....dllpath:..dw '%s',0....classname:..dw '%s',0....methodname:..dw '%s',0....paramstr:..dw '%s',0......IID_ICLRRuntimeHost4:..db 66 d3 f6 64 c2 d7 1f 4f b4 b2 e8 16 0c ac 43 af....injectdotnetdll:..[64-bit]..sub rsp,6*8+8..mov rcx,IID_ICLRRuntimeHost4..mov rdx,RuntimeHost..[/64-bit]....[32-bit]..push RuntimeHost..push IID_ICLRRuntimeHost4..[/32-bit]....call GetCLRRuntimeHost..cmp eax,0..jne error....[64-bit]..mov rcx,[Ru

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-BH2HL.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9243
                                                                                                                                                                                                                                            Entropy (8bit):4.766574177681985
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C64/8dXYKgLNhpwHmFUazyI+Q4Om1q/Qt:t4nHUKUa0Out
                                                                                                                                                                                                                                            MD5:40D6BFE593194CF938E19622A3C13A5E
                                                                                                                                                                                                                                            SHA1:761257E8EF492431CF0E04DBCA396FABB25FE1AE
                                                                                                                                                                                                                                            SHA-256:C4CEF60489B067C8E7ABCDD5594643A27D0720B21523753DD462D53024287116
                                                                                                                                                                                                                                            SHA-512:1D1AAA9DE74B0BB08CC4CECED5DBFA4C589347EAC098D7AE013D5A1BEAAE0EEACA4D314E2591560C6DF14A93DD4E9316CA317D21EFADCCA57D11EEE72F4C6E16
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'autosave.po')..end....require("lfs")....autosave={} --todo make local....local AutoSaveSettings=getSettings('Auto Save')..local AutoSaveVersion=1....autosave.getPath=function().. local path=AutoSaveSettings['SavePath'].. if (path==nil) or (path=='') then.. .. path=os.getenv("LOCALAPPDATA").. if (path==nil) or (path=='') then.. path=getCheatEngineDir() --last attempt .. end.. end.. .. if string.sub(path,#path)~='\\' then.. path=path..'\\'.. end.. .. return path..end....function autosave.saveState().... .. local pid=AutoSaveSettings['ProcessID'].. if pid and pid~='' then.. pid=tonumber(pid).. if pid~=getCheatEngineProcessID() then.. --another CE has done an autosave.. if getProcessList()[pid]==nil then.. --it doesn't exist anymore... messageDialog(translate('Another instance of Cheat Engine has crashed and it created an autosave. Autosave disabled until y

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-BOTFQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7354
                                                                                                                                                                                                                                            Entropy (8bit):4.798336095796441
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:K9yd/VQilJ6HLwxxKF9Znu8KX+qNdYSnatJoqVSQPFLqJ4:K0VPlJMgNdYSnatmqVSQPFLc4
                                                                                                                                                                                                                                            MD5:2BE703BF1FF1EA4DD6D1EFF673367E48
                                                                                                                                                                                                                                            SHA1:13C122CFD7EB38D298FA91F3D6021F025578B508
                                                                                                                                                                                                                                            SHA-256:6704BEF60F60F85E76AA19B96A43ACA74C4AA8905B4033A20C24B75171B33D0A
                                                                                                                                                                                                                                            SHA-512:E1FC1C55574F5FECEF535734A23DB9738D4C5762E085DEA721F9CD7F5F9F364DD1428F669F26149F1E49414F38A4C00BC7FD4F5E1A5C03A0E53B24C859B25C5E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local function genericJumpHandler(state, alwaystaken).. local origin=state.address.. local addressString=string.gsub(state.ldd.parameters,"qword ptr ","").. local addressString=string.gsub(addressString,"dword ptr ","").. local destination=getAddressSafe(addressString) --find out the destination.. local destination2.... if destination==nil then.. --in case of registers.. return.. end.... if not alwaystaken then.. destination2=origin+state.parsed[origin].bytesize.. end;...... state.branchOrigins[origin]={}.. state.branchOrigins[origin].destinationtaken=destination.. state.branchOrigins[origin].destinationnottaken=destination2.... if state.branchDestinations[destination]==nil then --list of destinations and their origin(s).. state.branchDestinations[destination]={}.. end.... table.insert(state.branchDestinations[destination], origin).... if not alwaystaken then.. if state.branchDestinations[destination2]==nil then --list of destinations and their origin(s).

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-BQADR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (338), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):84022
                                                                                                                                                                                                                                            Entropy (8bit):4.86677649912196
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:yui2L/B3vpXErHBRpUPrEUvh8VRzXzycAcnNSoaam0WEj:yurB6rhRpUPr9vszjycAcYoaam0WEj
                                                                                                                                                                                                                                            MD5:F30091A31003345EAE2A915D1EE13E9D
                                                                                                                                                                                                                                            SHA1:B42C1B7DA7E620A89A68274C7551D7BB3806441C
                                                                                                                                                                                                                                            SHA-256:CC505DA9EA622E39783D6AC0A98370E1B58EBA6702B9A1796FDC869AEEBBA261
                                                                                                                                                                                                                                            SHA-512:A9A801F42BF9A1ED54CBC2DC7AC397E6695EB685D4F03313059B08DB23ED9055727168B9AFFEE94416A584F703B9B97D515B6BC02FEF99F8EF6FB4B372AEE65E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--dotnetinfo is a passive .net query tool, but it can go to a active state if needed....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetinfo.po')..end....if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep='/'..end....debugInstanceLookup=false....local DPIMultiplier=(getScreenDPI()/96)..local CONTROL_MONO=0..local CONTROL_DOTNET=1....DataSource={} --All collected data about the current process. From domains, to images, to classes, to fields and methods. Saves on queries and multiple windows can use it..local CurrentProcess....local ELEMENT_TYPE_END = 0x00 -- End of List..local ELEMENT_TYPE_VOID = 0x01..local ELEMENT_TYPE_BOOLEAN = 0x02..local ELEMENT_TYPE_CHAR = 0x03..local ELEMENT_TYPE_I1 = 0x04..local ELEMENT_TYPE_U1 = 0x05..local ELEMENT_TYPE_I2 = 0x06..local ELEMENT_TYPE_U2 = 0x07..local ELEMENT_TYPE_I4 = 0x08..local ELEMENT_TYPE_U4 = 0x09..local ELEMENT_TYPE_I8

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-C9ULO.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14247
                                                                                                                                                                                                                                            Entropy (8bit):4.757455540825877
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:p1mEfPL5ThWRM8vLdyWR1hHS+6stplX7ZbaFYBY6tnGb:VfPjylLNkKW6tE
                                                                                                                                                                                                                                            MD5:26C0E56ABEBFB550A9D208D6191816E0
                                                                                                                                                                                                                                            SHA1:8F2392846633AC48A0168AFE9F20AFC124699F4C
                                                                                                                                                                                                                                            SHA-256:A825F660DF2E6C13DBECE0A0F8DC306129BD784F8DC4EFC37E67E9CDD00CE65F
                                                                                                                                                                                                                                            SHA-512:4FC8A18E2F24374953694CB9230D9DDBA7A1B69B3BA5574AE143CB79B8D0F7CD94E9DD7337EC58EA40769A4B552A583C466781AC7EFF50C9199EAB39AD2076A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'CeShare.po')..end....ceshare={}....function ceshare.getInternet().. if ceshare.internet==nil then.. ceshare.internet=getInternet('ceshare').. end.. return ceshare.internet..end....local pathsep..if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep=[[/]]..end....ceshare.version=-1..ceshare.path=getAutoRunPath()..'ceshare'..pathsep..ceshare.formpath=ceshare.path..pathsep..'forms'..pathsep..ceshare.imagepath=ceshare.path..pathsep..'images'..pathsep....if package.loaded.xmlSimple==nil then.. package.path=package.path..';'..getAutoRunPath()..'xml'..pathsep..'?.lua'..else.. package.loaded.xmlSimple=nil..end..ceshare.xmlParser = require("xmlSimple").newParser()......package.path=package.path..';'..ceshare.path..[[?.lua]]....function loadCEShare().. ceshare.settings=getSettings('ceshare').. ceshare.secondaryIdentifierCode=getSettings('ceshare\\secondaryIdentifierCode').... require("ceshare_account

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-CEL34.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15160
                                                                                                                                                                                                                                            Entropy (8bit):4.132367012227535
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:fTJbJcJtJZJtJeJAmDF3zY0PLTuHrRthutT9AT0HqkVWAcK3wMexR9WnraIeBXjJ:LJbJcJtJZJtJeJAmDF3zY0jTuHr7huFG
                                                                                                                                                                                                                                            MD5:C5D67D9CB5017F96F34CB9BA0F08FDF0
                                                                                                                                                                                                                                            SHA1:53DCA47CF042380F8DBC3399832A559A2C7368BD
                                                                                                                                                                                                                                            SHA-256:42896BBE75C79C381CC90FBAE685DA24013CAAD0786F1B1A4B569620C45F3F72
                                                                                                                                                                                                                                            SHA-512:C2F41A7C1A25B66B9DC0A496AD87818C9C7E3F70CEB82344AD7F664764293D2F9A43E607A4A299597E44B6763B3BFC63AD8F4EB01C6BD68EAE4BB04ACF775F42
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--dotnetsearch..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetsearch.po')..end....function spawnDotNetSearchDialog(DataSource, frmDotNetInfo, searchtype).... local currentScan --rule: only writable in mainthread.. local searchresults={}.. .. .. --spawns a searchdialog. searchtype has 3 options: 0-ClassName, 1-FieldName, 2-MethodName.. local frmSearch=createFormFromFile(getAutorunPath()..'forms'..pathsep..'DotNetSearch.frm') .. .. _G.frmSearch=frmSearch.. .. if searchtype==0 then.. frmSearch.Caption=translate('Find Class') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current image').. .. frmSearch.cbLimitToCurrentBase.Enabled=frmDotNetInfo.lbImages.ItemIndex>=0 .. frmSearch.lvResults.Columns.delete(2).. elseif searchtype==1 then.. frmSearch.Caption=translate('Find Field') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current class').. frmSearch.cbLimitToCurrentBase.Enabled=f

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-ECJSG.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2018
                                                                                                                                                                                                                                            Entropy (8bit):4.845505891620365
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8LRZCSs+dJPHoSLI0zAXFqfzhPR3sAuH7vMTCRTnoH7ADR09ZWgsAU1HTfHU1EP:IRZ7umKgl5s2+cZPs81u
                                                                                                                                                                                                                                            MD5:3E20F1013FB48A67FE59BEDE7B8E341B
                                                                                                                                                                                                                                            SHA1:8C8A4CB49C3B29DB2C47F84AAFD0416101722BFE
                                                                                                                                                                                                                                            SHA-256:96E4429192F9AB26F8BF9F9429F36B388AA69C3624781C61EA6DF7E1BCA9B49B
                                                                                                                                                                                                                                            SHA-512:99CF3F88C8B06DA0DBE8085DEE796BEC7A9533990A55FBCE7524A4F941B5ECF0E8EC975A4B032EB2AAABD116C0804995A75036C98A5E4058F25D78D08A11F3F2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local pm=AddressList.PopupMenu..local pmAddToNewGroup=createMenuItem(pm)..pmAddToNewGroup.Caption=translate('Add to new group')..pmAddToNewGroup.ImageIndex=MainForm.CreateGroup.ImageIndex..pm.Items.insert(MainForm.CreateGroup.MenuIndex, pmAddToNewGroup)....local oldOnPopup=AddressList.PopupMenu.OnPopup..AddressList.PopupMenu.OnPopup=function(s).. if oldOnPopup then.. oldOnPopup(s).. end.. pmAddToNewGroup.Visible=AddressList.SelCount>=1..end....pmAddToNewGroup.OnClick=function(s).. local i.. local count=0.. local selcount=0.. local withAddress=false.. local hasAddressSupport=false.... if AddressList.SelCount==0 then.. messageDialog('Please select at least one entry first', mtError, mbOK).. return.. end.... hasAddressSupport=AddressList[0].IsAddressGroupHeader~=nil.... for i=0,AddressList.Count-1 do.. if AddressList[i].IsGroupHeader then.. count=count+1.. end.. end...... local groupname=translate(string.format('Group %d',count+1)).. if (isKeyPressed(VK_

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-K2KFB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5446
                                                                                                                                                                                                                                            Entropy (8bit):5.106344058039722
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:UFbOaNZRB+TqamMsKs5EcDE0F39dLC/B9gn0TUTXM2sit8vD/Jae8:gaTqamQcN9dLq9QDM2fG7o
                                                                                                                                                                                                                                            MD5:4FF5CD5283B83CF4614D14E4363ED8F2
                                                                                                                                                                                                                                            SHA1:A435BF58C9E58211CADA8EA1AF2891EA488E4DD2
                                                                                                                                                                                                                                            SHA-256:45AD5D854DEE4CA07F60B5BA89CF328DD7B216A0EF3232A2647D15BE38C6C4C0
                                                                                                                                                                                                                                            SHA-512:8208B64CD2FFA356DCAC8463188325B1AF88C0598F231EA0E36E74DEC64E0C50740FC3DB26790BF39FA30C0D457B910A7F9EEC8E2049C04F48C793B58452A7A3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--mp3 sound extension....if oldcreateMemoryStream==nil then oldcreateMemoryStream = createMemoryStream end..function createMemoryStream().. local obj = oldcreateMemoryStream().. local oldwrite=obj.write.... obj.write = function (t,n) -- override default write.. local count=0.. for _,v in ipairs(t) do.. if count==n then break end.. oldwrite({v},1).. count=count+1.. end.. end.... obj.writeDword = function (v) obj.write(dwordToByteTable(v)) end.. obj.writeWord = function (v) obj.write(wordToByteTable(v)) end.... return obj..end......--convertMP3ToRIFFMP3(stream)..function convertMP3ToRIFFMP3(stream).. local riffmp3 = createMemoryStream().... local header = {.. 0x46464952,0x00000000,0x45564157,0x20746D66,0x0000001E,0x00020055,.. 0x0000AC44,0x00000000,0x00000001,0x0001000C,0x00000002,0x00010001,.. 0x61660571,0x00047463,0x2FF80000,0x61640014.. } -- default is 44100Hz , Stereo.... loca

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-L1524.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):5.052893474705733
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jFwErIVt0OdI+eGvJYazVId2EA3ivun0gVVjec0Lg0zVCAMBNXnGCWMdO:5myTjOId2p3ivIVje5tVDMBRnGV5
                                                                                                                                                                                                                                            MD5:9BA24A4B8CB68B40D229109565572F78
                                                                                                                                                                                                                                            SHA1:F2DABC40C3761FD9196291AB42943D580062CD11
                                                                                                                                                                                                                                            SHA-256:8B5608DAEDB4370990B65579EE8D1D5623644FD9C0BBE007211D5837DC690C72
                                                                                                                                                                                                                                            SHA-512:BEFA54FD6A87BAF24030B6E292E0D8E674FBD69B3424184582EB38D8AF2C8459E7728BC6F03032735A6A1B6C5FE459ECDB1C862BDBD390DC695F4085ABC3918A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Alice says hi!....local t=createTimer()..t.Interval=110000..t.OnTimer=function().. local f=getForm(0).. f.Width=f.Width+2.. f.Height=f.Height+2.... if t.Interval>10000 then.. t.Interval=t.Interval-10000.. end.... createMemoryStream().Size=math.random(65536*4,65536*32);..end

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-M1718.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):18412
                                                                                                                                                                                                                                            Entropy (8bit):5.0642202603121165
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:zGYmhPbvqKlu2uzKCM/muwu5gfMs5eQVQgQ2GO:zGkKl4zm/mhR
                                                                                                                                                                                                                                            MD5:E4FA493CBF4F5E932DCE648A78800616
                                                                                                                                                                                                                                            SHA1:B82C12B23AE06AC07AE61B0B599F055DC879C949
                                                                                                                                                                                                                                            SHA-256:ACFB9FDA20C347D8B7B2E513D38D2692BD054AE90B88E846460E66B986DD8D1C
                                                                                                                                                                                                                                            SHA-512:E0C4B9B757D4F38DBDB2C5CE11FA27EE742EDA97A20F098D38300C8DCF27015D5CFC8BFD658B6A7F48CFDECE9645DA633C32B18050598A368432F7B026826823
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....require([[autorun\javaClassEditor]])....--parser for .class files and java bytecode..--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html....--constant type values..java_CONSTANT_Class=7..java_CONSTANT_Fieldref=9..java_CONSTANT_Methodref=10..java_CONSTANT_InterfaceMethodref=11..java_CONSTANT_String=8..java_CONSTANT_Integer=3..java_CONSTANT_Float=4..java_CONSTANT_Long=5..java_CONSTANT_Double=6..java_CONSTANT_NameAndType=12..java_CONSTANT_Utf8=1..java_CONSTANT_MethodHandle=15..java_CONSTANT_MethodType=16..java_CONSTANT_InvokeDynamic=18......function java_read_u4(stream).. local b={string.byte(stream.data, stream.index,stream.index+4-1)}.. stream.index=stream.index+4.... return byteTableToDword({b[4],b[3],b[2],b[1]})..end......function java_read_u2(stream).. local b={string.byte(stream.data, stream.index,stream.index+2-1)}.. stream.index=stream.index+2.... return byteTableToWord({b

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-OA13J.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7984
                                                                                                                                                                                                                                            Entropy (8bit):4.628436564346363
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:hG6G275/GPinZJGJBo2HXwymhmBEO/66dogk:fG4/vnZJGJv3qABPm
                                                                                                                                                                                                                                            MD5:6BFAA8047A8912C979D8B7ADC21BEFC4
                                                                                                                                                                                                                                            SHA1:9DEB3F151A70B1DE2AF921E2C4A05A9AFBFE88DA
                                                                                                                                                                                                                                            SHA-256:7EFC51C61CEC0EF4330C63E8848AD17BF707CC7067F8F5E195AE69D373BF4D24
                                                                                                                                                                                                                                            SHA-512:BEC70863FE63321EC815164A84FC82F7F03139E668AC165E218B033C2E79150B405AE553CBD8543F3AEDC839DB35FC74C14348E080598FB7BC25FB7908386A0E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--patches a dotnet method. Prerequisite: Must not be inlined or generic, or anything complex....function ParseScriptTokens(script,values).. --parses the script for <> entries and looks up the value in the values table.. if script==nil then .. print(debug.traceback()).. error('ParseScriptTokens: script is nil') .. end.. if values==nil then .. print(debug.traceback()).. error('ParseScriptTokens: values is nil') .. end.. .. return string.gsub(script,"<(.-)>",function(v) .. local r=values[v].. if r then return r else return x end.. end)..end....function dotnetpatch_getAllReferences().. --gets a list of all assemblies.. --todo: if they are in-memory only, export them to a file first (create the mz/pe manually, just the metadata).. local r={}.. local sysfile.... if monopipe then.. mono_enumImages(function(img).. local n=mono_image_get_filename(img).. local ln=extractFileName(n:lower()).. if ln~='mscorlib.dll' and ln~='netstandard.dll' then..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-ONEVU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):136078
                                                                                                                                                                                                                                            Entropy (8bit):5.006188616081032
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:/t5zmxQLPqWuiXL9eqiK8uthP/xoiEFLWiP8bTg1b3lDWIkGkxv0C2r0EcD+JZSh:O5n6MJCAi7hXZS8YHo6FG7236nDZ
                                                                                                                                                                                                                                            MD5:76168CA68F3ED8ADE110B140244EFBAF
                                                                                                                                                                                                                                            SHA1:2AF08403D17A64B10429C8FCE68AA085A6B287B7
                                                                                                                                                                                                                                            SHA-256:5832B5AB00E84690AC1E780E8B1C4ABD9649465234C9FFA2CECB410BE66A6B8A
                                                                                                                                                                                                                                            SHA-512:80AD21D631934D2B8E368A5B2D3CB5F1889D4A65099C2D8CD8BA37EB721C1EBDC2C6549FC530514BF9F96976FFCBFD372150F1F16A6591DA013FE4F1D1BB070B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'monoscript.po')..end....local thread_checkifmonoanyhow=nil..local StructureElementCallbackID=nil..local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....local dpiscale=getScreenDPI()/96....--[[local]] monocache={}....mono_timeout=3000 --change to 0 to never timeout (meaning: 0 will freeze your face off if it breaks on a breakpoint, just saying ...)....MONO_DATACOLLECTORVERSION=20221207....MONOCMD_INITMONO=0..MONOCMD_OBJECT_GETCLASS=1..MONOCMD_ENUMDOMAINS=2..MONOCMD_SETCURRENTDOMAIN=3..MONOCMD_ENUMASSEMBLIES=4..MONOCMD_GETIMAGEFROMASSEMBLY=5..MONOCMD_GETIMAGENAME=6..MONOCMD_ENUMCLASSESINIMAGE=7..MONOCMD_ENUMFIELDSINCLASS=8..MONOCMD_ENUMMETHODSINCLASS=9..MONOCMD_COMPILEMETHOD=10..MONOCMD_GETMETHODHEADER=11..MONOCMD_GETMETHODHEADER_CODE=12..MONOCMD_LOOKUPRVA=13..MONOCMD_GETJITINFO=14..MONOCMD_FINDCLASS=15..MONOCMD_FIND

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-Q3C8H.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Algol 68 source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8862
                                                                                                                                                                                                                                            Entropy (8bit):4.974583347443069
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:b4QnfODIk5ktS+Xp7SjCjL6jSCXNB3mtS+jwKtwTZX:bwDIAoL6jfMbtwX
                                                                                                                                                                                                                                            MD5:18D66678D7078C907FDDB5CC4E16E94E
                                                                                                                                                                                                                                            SHA1:681DC425C522D1A87588E224980F539DE791F2C2
                                                                                                                                                                                                                                            SHA-256:D99600BD2A0E754423499C963953FBF16B5FF9CECADC44F1332733F08F3D3F6E
                                                                                                                                                                                                                                            SHA-512:D22C18C47D93C12ED60BF704C590AF3FE7D7D0BCC49B77939F18424F2D15241C084F7288AC1695F22EA97DE1C6605351DAAF98FB86A6D4269ADAE2C78642BA10
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'SaveSessions.po')..end......if cheatEngineIs64Bit() then.. if string.find(package.cpath, 'clibs64')==nil then.. package.cpath=package.cpath..[[;.\clibs64\?.dll]].. end..else.. if string.find(package.cpath, 'clibs32')==nil then.. package.cpath=package.cpath..[[;.\clibs32\?.dll]].. end..end....require("lfs")....function loadMemoryScan_internal(filename).. --print("loadMemoryScan").. .. --the thread is used to bypasses a bug in 6.3.....local ms=getCurrentMemscan()...local mf=getMainForm()...........local input,err=createFileStream(filename,fmOpenRead or fmShareDenyNone).. if input==nil then.. MessageDialog(err, mtError,mbOK).. return.. end.....local scanvalue=input.readAnsiString().. local originalFromAddress=input.readAnsiString() .. local originalToAddress=input.readAnsiString() ...local scantype=input.readByte()...local vartype=input.readByte().. .....local savedscancount=input.readByte(

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-SUR6B.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7574
                                                                                                                                                                                                                                            Entropy (8bit):4.744280698083541
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:J+/R0h8p0wyUYCCTLysSUDfH0HwjOtHdqFB2i6uMPV:LWBUDU9Er4V
                                                                                                                                                                                                                                            MD5:D609EA53AD996E63300E703ED98EAB08
                                                                                                                                                                                                                                            SHA1:8E19906C32BEE40E9A24CB82AB57D109AE11E038
                                                                                                                                                                                                                                            SHA-256:E0C48C9033C52F77AD7B1DF44E2BB81C2FEF868CE08D46054723BC8441F0C742
                                                                                                                                                                                                                                            SHA-512:CC85857D449F507477A12CB7D5BE31288BAECB3B41BD760EBF1BAD289771CC7EAAF608B74E421EDA948D0B45E02A6FC188474C0E926EAE20510C77D2AF8890A6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--version check update script for cheat engine..--Don't like it? Just delete this file. Easy as that....--For the translators:..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'VersionCheck.po')..end....local vsettings=getSettings("VersionCheck")....local VersionCheckThread....function CheckVersion(automatic).. --create a thread that will get the latest version and buildnumber.. if versionCheckThread==nil then.. versionCheckThread=createThread(function(t).. local i=getInternet('CEVersionCheck').. local r=i.getURL('https://cheatengine.org/latestversion.txt').... if r then.. local sl=createStringlist().. local newerVersion=false.. local latestVersionCompleteBuildNumber.. local latestVersionNumber.. local latestVersionString --separate for crap like 6.5.1 (can't show 6.51 to the user).. sl.Text=r.... if sl.Count<3 then.. t.synchronize(function().. if au

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-T0R2S.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (332), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):53565
                                                                                                                                                                                                                                            Entropy (8bit):4.994608075433237
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:kR7JxiEJ1FwKp/UnSkXZh/GZPbZ1/GZU29s4dwHvuhWaPg5jys9:Oiqp/UnSkXZh/GZPbZ1/GZUWm9
                                                                                                                                                                                                                                            MD5:96A64006F752ECD75FAED81F86212F93
                                                                                                                                                                                                                                            SHA1:1889EBB9C206866A7096F6ECD5B7CEC628DCDCBE
                                                                                                                                                                                                                                            SHA-256:4F0E7249A20147FB1E364B5B182D990E6D00BF6A2624EDAA368B65142DD08408
                                                                                                                                                                                                                                            SHA-512:01F01661B7C8DDDC2940FB8A6E3384C5BEBD1560703E510E7EC029A294AA0A49486B6948851D99C01594CBDDF75295D2F38AB4C1E7760AFA3E40B15151B0FB2B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--Java class editor......--[[..This will show an userinterface for editing java classes and will return a list of "patch" commands..that can be used with the runtime java class edit commands....e.g:..DefineLabel(spot)..InsertBytecode(spot, command)..ModifyBytecode(spot, command)..DeleteBytecode(spot) (could be ModifyBytecode(spot,"nop") )......The user should not have to know about exceptions and how their positions change with each insert/delete....gui:..listview:..index|byteindex|label |exception|instruction|..-----|---------|------|---------|-----------|..0 |0 | | |nop | Insert..0 |1 |l1: |ex1: |branch l1 | Delete.. Modify....--]]....--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-6.html......java_bytecodes={}....--[[..paramtypes:.. s1=signed 1 byte.. s2=signed 2 byte.. s4=signed 4 b

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-TSV58.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (301), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):57578
                                                                                                                                                                                                                                            Entropy (8bit):4.965043624755705
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:SDN7O8gQVISPW3R89Mvybxj/kTdg4YXj2P:SDN7OiPW3W9MvybxjM/dP
                                                                                                                                                                                                                                            MD5:49C105DC0F4E732802284180722747C2
                                                                                                                                                                                                                                            SHA1:CDC575490B51A252202BB5E37F0536870DD3CCA0
                                                                                                                                                                                                                                            SHA-256:43DAE8CFAA2C16B3D94C748DE250BBA2E16E9789C8B2F3395CB6ED4F79E624C6
                                                                                                                                                                                                                                            SHA-512:B3A582E1FB4BAF003F40262C888ADF84041874E729A97D8CFAED581C84B7B3F5823DAFA4249607D4E79B62AA30BC207632ECA9522A0866EDF1C57CFC8296EFE7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'pseudocodediagram.po')..end......--[[pseudocodediagram.lua]]--....local DPIAdjust=getScreenDPI()/96....--Global..diagramstyle = {}..diagramstyle.instruction_registerstyle = '[31;1m' --red + bold..diagramstyle.instruction_hexstyle = '[34;1m' --blue + bold..diagramstyle.instruction_symbolstyle = '[32;1m' --green + bold..diagramstyle.instruction_opcodestyle = '[1m' --bold..diagramstyle.link_defaultcolor = 0x00FF00FF --fuchsia..diagramstyle.link_nottakencolor = 0x000000FF --red..diagramstyle.link_takencolor = 0x00FF0000 --blue..diagramstyle.link_linethickness = 3*DPIAdjust..diagramstyle.link_arrowsize = math.ceil(5*DPIAdjust)..diagramstyle.link_pointdepth = 20*DPIAdjust --distance between links..diagramstyle.block_headershowsymbol = true..diagramstyle.block_bodyshowaddresses = fal

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-UU2LT.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7917
                                                                                                                                                                                                                                            Entropy (8bit):5.014591940837417
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:sQJpltyKlR4ZtoOQ9pttWKlR4vtGTQPpMlyFuVCQc6c0RhBmg:stKY59KYQ5JhUg
                                                                                                                                                                                                                                            MD5:E76FCD2ECD5B956D4579A676AA3EEA01
                                                                                                                                                                                                                                            SHA1:49ECBA5CCC531A40AD7805A126D38B44B4A36576
                                                                                                                                                                                                                                            SHA-256:0339BA0043AF5C058CF3A19DE9F90312D18F6BB2728F454EF403B531BD57AE42
                                                                                                                                                                                                                                            SHA-512:8443C213D4A626A358631F76A0CC4C106543CE58C94D34A96B88574B3E32AE742F28878B259A17823CA07EC521B06E32E572E7BC77E10951BC0984B07C0571C6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local scripts={}....local function registerBigEndianInt16()..scripts['2 Byte Big Endian'].type=registerCustomTypeAutoAssembler([[..alloc(TypeName,256)..alloc(ByteSize,4)..alloc(ConvertRoutine,1024)..alloc(ConvertBackRoutine,1024)....TypeName:..db '2 Byte Big Endian',0....ByteSize:..dd 2....//The convert routine should hold a routine that converts the data to an integer (in eax)..//function declared as: stdcall int ConvertRoutine(unsigned char *input);..//Note: Keep in mind that this routine can be called by multiple threads at the same time...ConvertRoutine:..//jmp dllname.functionname..[64-bit]..//or manual:..//parameters: (64-bit)..//rcx=address of input..xor eax,eax..mov ax,[rcx] //eax now contains the bytes 'input' pointed to..xchg ah,al //convert to big endian....ret..[/64-bit]....[32-bit]..//jmp dllname.functionname..//or manual:..//parameters: (32-bit)..push ebp..mov ebp,esp..//[ebp+8]=input..//example:..mov eax,[ebp+8] //place the address that contains the bytes into eax..mov a

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\is-V0207.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7632
                                                                                                                                                                                                                                            Entropy (8bit):4.883983761190223
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:peDFQNTce2Qt5q/sn2Wdk7RlxJKTiZjYsfUv:p3ue2F7RlxJfYP
                                                                                                                                                                                                                                            MD5:459B793E0DC43A993F03D8B612F67CEC
                                                                                                                                                                                                                                            SHA1:F14AE9AFBE97AF534A11BF98AC1CC096269F1474
                                                                                                                                                                                                                                            SHA-256:E2CBB4C2F46305BB07D84222231012FD4C800FE8E1B43E0AA1AF9B6C5D111F7F
                                                                                                                                                                                                                                            SHA-512:1740068E3419D153ECBD9D1A6AADA20AABE71915E7422DCE1A83E616E8D2A1084922A81741591A682531E1F8146E437D8688521C7707A4909E5721768A3F956E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Copyright Cheat Engine......local function getOriginalCodeAndFiller(address).. local original,filler.... if type(address)~='number' then.. address=getAddressSafe(address).. end.... if address==nil then.. return nil, 'invalid address'.. end.... local sl=createStringList().. local d=createDisassembler().. local size=0.. while size<5 do.. d.disassemble(address).. local ldd=d.LastDisassembleData.. local inst=ldd.opcode..' '..ldd.parameters.. sl.add(inst).. size=size+#ldd.bytes.. address=address+#ldd.bytes.. end.... original=sl.Text.. if size-5>0 then.. filler=string.format("nop %x", size-5).. else.. filler=''.. end.... sl.destroy().. d.destroy().. return original,filler..end......local function hookSpeedFunctions().. if speedhack and speedhack.processid==getOpenedProcessID() then .. return true.. end.... local result, data=autoAssemble([[.. alloc(speedhack_wantedspeed,4).. registersymbol(speedhack_wantedspeed).. speedhack_w

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\java.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (312), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64056
                                                                                                                                                                                                                                            Entropy (8bit):5.143902164750308
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:/ilZhlpsM/bJ+CGLM0oJyevomQ385GxwuyC+N/0nNjoHhjCL:/ilZhlpsM6M0oJyUomQMUyC+N/0ZoCL
                                                                                                                                                                                                                                            MD5:54151E1842473981D08C4B1B69CEB46C
                                                                                                                                                                                                                                            SHA1:26CCFFD2AD4DE7FEA9CA7B11FBFBCF5CA3E9EA00
                                                                                                                                                                                                                                            SHA-256:B318D2AC5CF96BA8A0A36EDDBB62B250004D44F214BB10C0E82E4F2DDBDA95D9
                                                                                                                                                                                                                                            SHA-512:F9B76F51F089807610052D1DA2F147975EA3A2FF00C70FC373087A9CE55E24337F52174F062D5EC262FF9227F98CB32E09753B4E5A68FB443D8EB27890607B73
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--todo: split up into multiple units and use the java table for the methods as well......JAVACMD_STARTCODECALLBACKS=0..JAVACMD_STOPCODECALLBACKS=1..JAVACMD_GETLOADEDCLASSES=2..JAVACMD_DEREFERENCELOCALOBJECT=3..JAVACMD_GETCLASSMETHODS=4..JAVACMD_GETCLASSFIELDS=5..JAVACMD_GETIMPLEMENTEDINTERFACES=6..JAVAVMD_FINDREFERENCESTOOBJECT=7..JAVACMD_FINDJOBJECT=8..JAVACMD_GETCLASSSIGNATURE=9 --=getClassName..JAVACMD_GETSUPERCLASS=10..JAVACMD_GETOBJECTCLASS=11..JAVACMD_GETCLASSDATA=12..JAVACMD_REDEFINECLASS=13..JAVACMD_FINDCLASS=14..JAVACMD_GETCAPABILITIES=15..JAVACMD_GETMETHODNAME=16 --gets the methodname and the signature..JAVACMD_INVOKEMETHOD=17..JAVACMD_FINDCLASSOBJECTS=18 --find objects that belong to the given class..JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH=19..JAVACMD_ADDTOSYSTEMCLASSLOADERPATH=20..JAVACMD_PUSHLOCALFRAME=21..JAVACMD_POPLOCALFRAME=22..JAVACMD_GETFIELDDECLARINGCLASS=23..JAVACMD_GETFIELDS

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\javaClassEditor.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (332), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):53565
                                                                                                                                                                                                                                            Entropy (8bit):4.994608075433237
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:kR7JxiEJ1FwKp/UnSkXZh/GZPbZ1/GZU29s4dwHvuhWaPg5jys9:Oiqp/UnSkXZh/GZPbZ1/GZUWm9
                                                                                                                                                                                                                                            MD5:96A64006F752ECD75FAED81F86212F93
                                                                                                                                                                                                                                            SHA1:1889EBB9C206866A7096F6ECD5B7CEC628DCDCBE
                                                                                                                                                                                                                                            SHA-256:4F0E7249A20147FB1E364B5B182D990E6D00BF6A2624EDAA368B65142DD08408
                                                                                                                                                                                                                                            SHA-512:01F01661B7C8DDDC2940FB8A6E3384C5BEBD1560703E510E7EC029A294AA0A49486B6948851D99C01594CBDDF75295D2F38AB4C1E7760AFA3E40B15151B0FB2B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--Java class editor......--[[..This will show an userinterface for editing java classes and will return a list of "patch" commands..that can be used with the runtime java class edit commands....e.g:..DefineLabel(spot)..InsertBytecode(spot, command)..ModifyBytecode(spot, command)..DeleteBytecode(spot) (could be ModifyBytecode(spot,"nop") )......The user should not have to know about exceptions and how their positions change with each insert/delete....gui:..listview:..index|byteindex|label |exception|instruction|..-----|---------|------|---------|-----------|..0 |0 | | |nop | Insert..0 |1 |l1: |ex1: |branch l1 | Delete.. Modify....--]]....--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-6.html......java_bytecodes={}....--[[..paramtypes:.. s1=signed 1 byte.. s2=signed 2 byte.. s4=signed 4 b

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\javaclass.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):18412
                                                                                                                                                                                                                                            Entropy (8bit):5.0642202603121165
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:zGYmhPbvqKlu2uzKCM/muwu5gfMs5eQVQgQ2GO:zGkKl4zm/mhR
                                                                                                                                                                                                                                            MD5:E4FA493CBF4F5E932DCE648A78800616
                                                                                                                                                                                                                                            SHA1:B82C12B23AE06AC07AE61B0B599F055DC879C949
                                                                                                                                                                                                                                            SHA-256:ACFB9FDA20C347D8B7B2E513D38D2692BD054AE90B88E846460E66B986DD8D1C
                                                                                                                                                                                                                                            SHA-512:E0C4B9B757D4F38DBDB2C5CE11FA27EE742EDA97A20F098D38300C8DCF27015D5CFC8BFD658B6A7F48CFDECE9645DA633C32B18050598A368432F7B026826823
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....require([[autorun\javaClassEditor]])....--parser for .class files and java bytecode..--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html....--constant type values..java_CONSTANT_Class=7..java_CONSTANT_Fieldref=9..java_CONSTANT_Methodref=10..java_CONSTANT_InterfaceMethodref=11..java_CONSTANT_String=8..java_CONSTANT_Integer=3..java_CONSTANT_Float=4..java_CONSTANT_Long=5..java_CONSTANT_Double=6..java_CONSTANT_NameAndType=12..java_CONSTANT_Utf8=1..java_CONSTANT_MethodHandle=15..java_CONSTANT_MethodType=16..java_CONSTANT_InvokeDynamic=18......function java_read_u4(stream).. local b={string.byte(stream.data, stream.index,stream.index+4-1)}.. stream.index=stream.index+4.... return byteTableToDword({b[4],b[3],b[2],b[1]})..end......function java_read_u2(stream).. local b={string.byte(stream.data, stream.index,stream.index+2-1)}.. stream.index=stream.index+2.... return byteTableToWord({b

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\luasymbols.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):629
                                                                                                                                                                                                                                            Entropy (8bit):4.667259230622991
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:03Iw9kSSIEPchubhxoyPJ4y/oJf3DftSg0n/iyHfHHEo44JsITT+wF:03IwRCfPJ1/wKrHfHh4AsATvF
                                                                                                                                                                                                                                            MD5:DF4D243AB0407A1F03CCF448232FCF62
                                                                                                                                                                                                                                            SHA1:62453CFA7ABF6FA83158BE1BA86C854D9A6B7D4B
                                                                                                                                                                                                                                            SHA-256:C5A35380AF8BEBE96B85377F5F41F8C068CB857C74B9CB85B7467B35C1DE10C4
                                                                                                                                                                                                                                            SHA-512:4B05B65909673E92F59AB64C1FF4E0B829F5C9085EAFA1FFF28CB0CCD7E6A7F6EF031633F443E0BA156A4B8F5009F526D0356F39EF77B22706F98F100B1909C2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:luasymbols=registerSymbolLookupCallback(function(str).. if str then.. local firstchar=str:sub(1,1).. .. if (firstchar=='\'') or (firstchar=='\"') then.. return nil.. end.. .. local c='return '..str.. local lc=loadstring(c).. if lc then.. local isvalid,result=pcall(lc).. if isvalid then.. return result.. else.. return nil.. end.. end.. end..end, slNotSymbol) ....registerEXETrainerFeature('Lua Symbols', function().. local r={}.. r[1]={}.. r[1].PathToFile=getCheatEngineDir()..[[autorun\luasymbols.lua]].. r[1].RelativePath=[[autorun\]].. .. return r..end)

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\modulelistscan.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2095
                                                                                                                                                                                                                                            Entropy (8bit):4.920154640424097
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:gzax3OK42b8w6aBxVpKDRKLYChKr+deaUAyA16AhXaAe76:gzax+KIPazVpKDRaNhKr+dlUDy6GXapW
                                                                                                                                                                                                                                            MD5:CA347DEF8A682D2ADF951C4ECBABD948
                                                                                                                                                                                                                                            SHA1:C65BBC8A5106E9ACE9DDC450EC3A5F637704FA62
                                                                                                                                                                                                                                            SHA-256:1F11078B143B92612822F3DFC09D93778471198F203694C8FC911E249FBBC557
                                                                                                                                                                                                                                            SHA-512:9F7A08822D9357AF72A27707C17FC0D3EC03E72333D88E2BA8E2BE95EAB7BA9C1B33EA3E2E20D734C382F4732F77443D3AA9C189667A74195987F5DB486E2651
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local c=createComboBox(MainForm.gbScanOptions)....c.Style='csDropDownList'..c.Items.add('All')..c.ItemIndex=0..c.Name='ScanOptionsModuleList' ......c.Align=alTop..c.BorderSpacing.Left=6..c.BorderSpacing.Right=6..c.BorderSpacing.Bottom=2....local modulelist....function FillList().. local is64bit=targetIs64Bit().. local op.. if is64bit then.. op='32'.. else.. op='64'.. end.. synchronize(function() .. while c.Items.Count>1 do.. c.Items.delete(1).. end.. end).... modulelist=enumModules().. .. synchronize(function().. if modulelist then.. local i.. for i=1, #modulelist do.. modulelist[i].OriginalName=modulelist[i].Name.. if modulelist[i].Is64Bit ~= is64bit then.. modulelist[i].OriginalName='_'..modulelist[i].OriginalName.. modulelist[i].Name=modulelist[i].Name..' ('..op..'-bit)'.. end.... c.Items.Add(modulelist[i].Name).. end.. end.. end)..end....c.OnMouseEnter=function(d) .. if c.Items.Count<

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\monoscript.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):136078
                                                                                                                                                                                                                                            Entropy (8bit):5.006188616081032
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:/t5zmxQLPqWuiXL9eqiK8uthP/xoiEFLWiP8bTg1b3lDWIkGkxv0C2r0EcD+JZSh:O5n6MJCAi7hXZS8YHo6FG7236nDZ
                                                                                                                                                                                                                                            MD5:76168CA68F3ED8ADE110B140244EFBAF
                                                                                                                                                                                                                                            SHA1:2AF08403D17A64B10429C8FCE68AA085A6B287B7
                                                                                                                                                                                                                                            SHA-256:5832B5AB00E84690AC1E780E8B1C4ABD9649465234C9FFA2CECB410BE66A6B8A
                                                                                                                                                                                                                                            SHA-512:80AD21D631934D2B8E368A5B2D3CB5F1889D4A65099C2D8CD8BA37EB721C1EBDC2C6549FC530514BF9F96976FFCBFD372150F1F16A6591DA013FE4F1D1BB070B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'monoscript.po')..end....local thread_checkifmonoanyhow=nil..local StructureElementCallbackID=nil..local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....local dpiscale=getScreenDPI()/96....--[[local]] monocache={}....mono_timeout=3000 --change to 0 to never timeout (meaning: 0 will freeze your face off if it breaks on a breakpoint, just saying ...)....MONO_DATACOLLECTORVERSION=20221207....MONOCMD_INITMONO=0..MONOCMD_OBJECT_GETCLASS=1..MONOCMD_ENUMDOMAINS=2..MONOCMD_SETCURRENTDOMAIN=3..MONOCMD_ENUMASSEMBLIES=4..MONOCMD_GETIMAGEFROMASSEMBLY=5..MONOCMD_GETIMAGENAME=6..MONOCMD_ENUMCLASSESINIMAGE=7..MONOCMD_ENUMFIELDSINCLASS=8..MONOCMD_ENUMMETHODSINCLASS=9..MONOCMD_COMPILEMETHOD=10..MONOCMD_GETMETHODHEADER=11..MONOCMD_GETMETHODHEADER_CODE=12..MONOCMD_LOOKUPRVA=13..MONOCMD_GETJITINFO=14..MONOCMD_FINDCLASS=15..MONOCMD_FIND

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\patchscan.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17557
                                                                                                                                                                                                                                            Entropy (8bit):4.7553596901580395
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:02/2WiurcwWJsFH1bukLWmHwt/5B9ndDiC4fVAslnlKQ8gLIeHkSD//TVxVkB8CZ:HtWIBugO8ieHkSDnTVTnC8i+lLQC/6
                                                                                                                                                                                                                                            MD5:F2896031568F43A7E4A7529A16F4EA12
                                                                                                                                                                                                                                            SHA1:A24B17AEC47FB290EE29BFC01C7386B85827D14E
                                                                                                                                                                                                                                            SHA-256:0714BD0F908345D7588A09C856746D76861CE4EB3571692BABC1BCE2D35A57AA
                                                                                                                                                                                                                                            SHA-512:B4F9EBB1E8375045269FF11FE2B6AEC3C31E64AB89CDDBFF1D26451DB3426AE841E28D184539959F84248CF101854F47E8F3497BA8414460ABCAC3C0D66248B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local DPIMultiplier=(getScreenDPI()/96)....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'patchscan.po')..end....local IMAGE_SCN_CNT_CODE=0x20..local IMAGE_SCN_MEM_EXECUTE=0x20000000....function byteTableToHexString(bt).. local i.. local r=''.... if bt then.. for i=1,#bt do.. r=r..string.format("%.2x ",bt[i]).. end.. end.. return r..end......function scanModuleForPatches(modulepath, loadedModuleBase, thread).... local original=createMemoryStream().. local r,e=original.loadFromFileNoError(modulepath).. if not r then.. original.destroy().. return false,e.. end.. original.Position=0...... if (byteTableToString(original.read(2))~='MZ') then.. original.destroy().. return nil,translate('Not a valid executable').. end.... original.Position=60;.. local lfanew=original.readDword();.. original.Position=lfanew;.... if (byteTableToString(original.read(2))~='PE') then.. original.destroy().. return nil,translate('Not a valid win

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\pseudocode.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7354
                                                                                                                                                                                                                                            Entropy (8bit):4.798336095796441
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:K9yd/VQilJ6HLwxxKF9Znu8KX+qNdYSnatJoqVSQPFLqJ4:K0VPlJMgNdYSnatmqVSQPFLc4
                                                                                                                                                                                                                                            MD5:2BE703BF1FF1EA4DD6D1EFF673367E48
                                                                                                                                                                                                                                            SHA1:13C122CFD7EB38D298FA91F3D6021F025578B508
                                                                                                                                                                                                                                            SHA-256:6704BEF60F60F85E76AA19B96A43ACA74C4AA8905B4033A20C24B75171B33D0A
                                                                                                                                                                                                                                            SHA-512:E1FC1C55574F5FECEF535734A23DB9738D4C5762E085DEA721F9CD7F5F9F364DD1428F669F26149F1E49414F38A4C00BC7FD4F5E1A5C03A0E53B24C859B25C5E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:local function genericJumpHandler(state, alwaystaken).. local origin=state.address.. local addressString=string.gsub(state.ldd.parameters,"qword ptr ","").. local addressString=string.gsub(addressString,"dword ptr ","").. local destination=getAddressSafe(addressString) --find out the destination.. local destination2.... if destination==nil then.. --in case of registers.. return.. end.... if not alwaystaken then.. destination2=origin+state.parsed[origin].bytesize.. end;...... state.branchOrigins[origin]={}.. state.branchOrigins[origin].destinationtaken=destination.. state.branchOrigins[origin].destinationnottaken=destination2.... if state.branchDestinations[destination]==nil then --list of destinations and their origin(s).. state.branchDestinations[destination]={}.. end.... table.insert(state.branchDestinations[destination], origin).... if not alwaystaken then.. if state.branchDestinations[destination2]==nil then --list of destinations and their origin(s).

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\pseudocodediagram.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (301), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):57578
                                                                                                                                                                                                                                            Entropy (8bit):4.965043624755705
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:SDN7O8gQVISPW3R89Mvybxj/kTdg4YXj2P:SDN7OiPW3W9MvybxjM/dP
                                                                                                                                                                                                                                            MD5:49C105DC0F4E732802284180722747C2
                                                                                                                                                                                                                                            SHA1:CDC575490B51A252202BB5E37F0536870DD3CCA0
                                                                                                                                                                                                                                            SHA-256:43DAE8CFAA2C16B3D94C748DE250BBA2E16E9789C8B2F3395CB6ED4F79E624C6
                                                                                                                                                                                                                                            SHA-512:B3A582E1FB4BAF003F40262C888ADF84041874E729A97D8CFAED581C84B7B3F5823DAFA4249607D4E79B62AA30BC207632ECA9522A0866EDF1C57CFC8296EFE7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'pseudocodediagram.po')..end......--[[pseudocodediagram.lua]]--....local DPIAdjust=getScreenDPI()/96....--Global..diagramstyle = {}..diagramstyle.instruction_registerstyle = '[31;1m' --red + bold..diagramstyle.instruction_hexstyle = '[34;1m' --blue + bold..diagramstyle.instruction_symbolstyle = '[32;1m' --green + bold..diagramstyle.instruction_opcodestyle = '[1m' --bold..diagramstyle.link_defaultcolor = 0x00FF00FF --fuchsia..diagramstyle.link_nottakencolor = 0x000000FF --red..diagramstyle.link_takencolor = 0x00FF0000 --blue..diagramstyle.link_linethickness = 3*DPIAdjust..diagramstyle.link_arrowsize = math.ceil(5*DPIAdjust)..diagramstyle.link_pointdepth = 20*DPIAdjust --distance between links..diagramstyle.block_headershowsymbol = true..diagramstyle.block_bodyshowaddresses = fal

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\savesession.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Algol 68 source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8862
                                                                                                                                                                                                                                            Entropy (8bit):4.974583347443069
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:b4QnfODIk5ktS+Xp7SjCjL6jSCXNB3mtS+jwKtwTZX:bwDIAoL6jfMbtwX
                                                                                                                                                                                                                                            MD5:18D66678D7078C907FDDB5CC4E16E94E
                                                                                                                                                                                                                                            SHA1:681DC425C522D1A87588E224980F539DE791F2C2
                                                                                                                                                                                                                                            SHA-256:D99600BD2A0E754423499C963953FBF16B5FF9CECADC44F1332733F08F3D3F6E
                                                                                                                                                                                                                                            SHA-512:D22C18C47D93C12ED60BF704C590AF3FE7D7D0BCC49B77939F18424F2D15241C084F7288AC1695F22EA97DE1C6605351DAAF98FB86A6D4269ADAE2C78642BA10
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'SaveSessions.po')..end......if cheatEngineIs64Bit() then.. if string.find(package.cpath, 'clibs64')==nil then.. package.cpath=package.cpath..[[;.\clibs64\?.dll]].. end..else.. if string.find(package.cpath, 'clibs32')==nil then.. package.cpath=package.cpath..[[;.\clibs32\?.dll]].. end..end....require("lfs")....function loadMemoryScan_internal(filename).. --print("loadMemoryScan").. .. --the thread is used to bypasses a bug in 6.3.....local ms=getCurrentMemscan()...local mf=getMainForm()...........local input,err=createFileStream(filename,fmOpenRead or fmShareDenyNone).. if input==nil then.. MessageDialog(err, mtError,mbOK).. return.. end.....local scanvalue=input.readAnsiString().. local originalFromAddress=input.readAnsiString() .. local originalToAddress=input.readAnsiString() ...local scantype=input.readByte()...local vartype=input.readByte().. .....local savedscancount=input.readByte(

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\soundextension.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5446
                                                                                                                                                                                                                                            Entropy (8bit):5.106344058039722
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:UFbOaNZRB+TqamMsKs5EcDE0F39dLC/B9gn0TUTXM2sit8vD/Jae8:gaTqamQcN9dLq9QDM2fG7o
                                                                                                                                                                                                                                            MD5:4FF5CD5283B83CF4614D14E4363ED8F2
                                                                                                                                                                                                                                            SHA1:A435BF58C9E58211CADA8EA1AF2891EA488E4DD2
                                                                                                                                                                                                                                            SHA-256:45AD5D854DEE4CA07F60B5BA89CF328DD7B216A0EF3232A2647D15BE38C6C4C0
                                                                                                                                                                                                                                            SHA-512:8208B64CD2FFA356DCAC8463188325B1AF88C0598F231EA0E36E74DEC64E0C50740FC3DB26790BF39FA30C0D457B910A7F9EEC8E2049C04F48C793B58452A7A3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--mp3 sound extension....if oldcreateMemoryStream==nil then oldcreateMemoryStream = createMemoryStream end..function createMemoryStream().. local obj = oldcreateMemoryStream().. local oldwrite=obj.write.... obj.write = function (t,n) -- override default write.. local count=0.. for _,v in ipairs(t) do.. if count==n then break end.. oldwrite({v},1).. count=count+1.. end.. end.... obj.writeDword = function (v) obj.write(dwordToByteTable(v)) end.. obj.writeWord = function (v) obj.write(wordToByteTable(v)) end.... return obj..end......--convertMP3ToRIFFMP3(stream)..function convertMP3ToRIFFMP3(stream).. local riffmp3 = createMemoryStream().... local header = {.. 0x46464952,0x00000000,0x45564157,0x20746D66,0x0000001E,0x00020055,.. 0x0000AC44,0x00000000,0x00000001,0x0001000C,0x00000002,0x00010001,.. 0x61660571,0x00047463,0x2FF80000,0x61640014.. } -- default is 44100Hz , Stereo.... loca

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\versioncheck.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7574
                                                                                                                                                                                                                                            Entropy (8bit):4.744280698083541
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:J+/R0h8p0wyUYCCTLysSUDfH0HwjOtHdqFB2i6uMPV:LWBUDU9Er4V
                                                                                                                                                                                                                                            MD5:D609EA53AD996E63300E703ED98EAB08
                                                                                                                                                                                                                                            SHA1:8E19906C32BEE40E9A24CB82AB57D109AE11E038
                                                                                                                                                                                                                                            SHA-256:E0C48C9033C52F77AD7B1DF44E2BB81C2FEF868CE08D46054723BC8441F0C742
                                                                                                                                                                                                                                            SHA-512:CC85857D449F507477A12CB7D5BE31288BAECB3B41BD760EBF1BAD289771CC7EAAF608B74E421EDA948D0B45E02A6FC188474C0E926EAE20510C77D2AF8890A6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--version check update script for cheat engine..--Don't like it? Just delete this file. Easy as that....--For the translators:..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'VersionCheck.po')..end....local vsettings=getSettings("VersionCheck")....local VersionCheckThread....function CheckVersion(automatic).. --create a thread that will get the latest version and buildnumber.. if versionCheckThread==nil then.. versionCheckThread=createThread(function(t).. local i=getInternet('CEVersionCheck').. local r=i.getURL('https://cheatengine.org/latestversion.txt').... if r then.. local sl=createStringlist().. local newerVersion=false.. local latestVersionCompleteBuildNumber.. local latestVersionNumber.. local latestVersionString --separate for crap like 6.5.1 (can't show 6.51 to the user).. sl.Text=r.... if sl.Count<3 then.. t.synchronize(function().. if au

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\xml\is-GNT57.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6083
                                                                                                                                                                                                                                            Entropy (8bit):4.574208772239494
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:j2S/HgQOsILKD/nMed210naDVOPkkmVBgB+CPcGhJpl:j2iHgQOsILKD/nMed210ngOPkkmVBPG3
                                                                                                                                                                                                                                            MD5:274946677CB1FB1C63A04AEB641E21D0
                                                                                                                                                                                                                                            SHA1:B4C71B59792773F20878E3BA582331CF4EA7D592
                                                                                                                                                                                                                                            SHA-256:05258E280F53C5905AE374F808F4383CFD0898F6E620D875136EDEB0FDBA34F5
                                                                                                                                                                                                                                            SHA-512:AAC74D0DA491AC3E9465964A3861F93EACD63D2C445C1F235FED444F60F9CE19D3BF5069BD012AE72593516DB96CA4A0FDFA07E83218466743551CBF1A6A64EF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--module(..., package.seeall)..local f={}....---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..--..-- Original source: https://github.com/Cluain/Lua-Simple-XML-Parser..--..-- xml.lua - XML parser for use with the Corona SDK...--..-- version: 1.2..--..-- CHANGELOG:..--..-- 1.2 - Created new structure for returned table..-- 1.1 - Fixed base directory issue with the loadFile() function...--..-- NOTE: This is a modified version of Alexander Makeev's Lua-only XML parser..-- found here: http://lua-users.org/wiki/LuaXml..--..---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..function f.newParser().... XmlParser = {};.... function XmlParser:ToXmlString(value).. value = string.gsub(value, "&", "&amp;"); -- '&' -> "&amp;".. value = string.gsub(value

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\autorun\xml\xmlSimple.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6083
                                                                                                                                                                                                                                            Entropy (8bit):4.574208772239494
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:j2S/HgQOsILKD/nMed210naDVOPkkmVBgB+CPcGhJpl:j2iHgQOsILKD/nMed210ngOPkkmVBPG3
                                                                                                                                                                                                                                            MD5:274946677CB1FB1C63A04AEB641E21D0
                                                                                                                                                                                                                                            SHA1:B4C71B59792773F20878E3BA582331CF4EA7D592
                                                                                                                                                                                                                                            SHA-256:05258E280F53C5905AE374F808F4383CFD0898F6E620D875136EDEB0FDBA34F5
                                                                                                                                                                                                                                            SHA-512:AAC74D0DA491AC3E9465964A3861F93EACD63D2C445C1F235FED444F60F9CE19D3BF5069BD012AE72593516DB96CA4A0FDFA07E83218466743551CBF1A6A64EF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--module(..., package.seeall)..local f={}....---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..--..-- Original source: https://github.com/Cluain/Lua-Simple-XML-Parser..--..-- xml.lua - XML parser for use with the Corona SDK...--..-- version: 1.2..--..-- CHANGELOG:..--..-- 1.2 - Created new structure for returned table..-- 1.1 - Fixed base directory issue with the loadFile() function...--..-- NOTE: This is a modified version of Alexander Makeev's Lua-only XML parser..-- found here: http://lua-users.org/wiki/LuaXml..--..---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..function f.newParser().... XmlParser = {};.... function XmlParser:ToXmlString(value).. value = string.gsub(value, "&", "&amp;"); -- '&' -> "&amp;".. value = string.gsub(value

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\bullet.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):187
                                                                                                                                                                                                                                            Entropy (8bit):5.975104411893651
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:yionv//thPlg5UwjHTAadCmy9h/rywOia85Fxf1v1JClwBWfxvo4AzsOfdp:6v/lhP+KWHT19ghmIFxRiwBYFfAzswdp
                                                                                                                                                                                                                                            MD5:8BCC2E16763817795E4E81EC86457038
                                                                                                                                                                                                                                            SHA1:050BDB436ADC138D2559D96842A5DD39FA1CF315
                                                                                                                                                                                                                                            SHA-256:CDFC96FBA6EFD3F26C779B4A892AFFFC292D451CC94104C3272B258E17204D07
                                                                                                                                                                                                                                            SHA-512:E992395ABE6F058F3135F5734789C1F4865F865E763BBB10CCE371BCC191E9DD358C1C633C8597601695B73AC008FC864A1AF6920501731E9FCF1C26344ACC22
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............1.5;....bKGD..............pHYs..........+......tIME......%..{....HIDAT..}.... ......tD?&..LM..8....*.:...=/...mVb....U....@.V.".ge.?.~6r...4Nw..!....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\door.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):179
                                                                                                                                                                                                                                            Entropy (8bit):5.695302062158259
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:yionv//thPlul4fRAadCmy9h/rywOievplxdGt0skV6UhhJnElnbgsrZsYp0rx1p:6v/lhPVfR19ghmFlyOho5gesE0Pp
                                                                                                                                                                                                                                            MD5:036394E78B67C1F5C2E1773B74D148E9
                                                                                                                                                                                                                                            SHA1:3B78B52F1C67BBA12A147BFCB805D6F913E70667
                                                                                                                                                                                                                                            SHA-256:96200DBE8BD64BDF2A85E1FE45FF2169FA08B080425A0F32E4F08A65D83CAB5B
                                                                                                                                                                                                                                            SHA-512:2156BD6E61EA3299F8CB83D9AB1A24062A7AAD743FCED71FBB108AE6F9FC5EBA72843D1619EFA5A9091402631739DDD960C17968B1A4A1027296CECC254C0E65
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME........<.s...@IDAT8.c....?......0p.Y...H.......qE..........YHS....C.f....LG........6....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\infobutton.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):707
                                                                                                                                                                                                                                            Entropy (8bit):7.4418596058676645
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7GmBjAkh8fjIqLe7yagUPqvMPwE5t7frC1Tt00JETw0jg3Or2ksPd:/mBjAkh8fsqa7W2wEPDov3oQl
                                                                                                                                                                                                                                            MD5:45E0091B87215F768F524DBBEDEDD74E
                                                                                                                                                                                                                                            SHA1:9835B0E117146128C5EED7E43FBE1602C5C1BC23
                                                                                                                                                                                                                                            SHA-256:576467863491FAEDE8053F95BD0C66CF3C273F6B27A05984F81F51AA289191BE
                                                                                                                                                                                                                                            SHA-512:D627E4A81E32542A455A26B775E6CE30580658F4443CB84CF23022ADEC83A315264CE3FAEDD4315A62625843582396B76E994C6C0A91C2C63BB514B05B9ABE6B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME........-.%...PIDATh...1R.0...;?.W@E.".`.@..<.2?....R....4.M&...DCf.cY'..t2.....,..IFP..s...DD.~a.A.;*.......5.H.`... ..........F.....T....|.SQbA..As....` .B....B....810...@.H.......H....+.<.....(...\"B.F..u....]........~^..C7q..k.zp.Lh.p..{z.EG.. #.Z'........ w....c.^9*.!v....3.&.!>-Zp..../.... 7.......O...>.f.*y..3....G.....)=.......+G...... F...G....`.b+.QV..WB0.1.";.....F.~+.?.D..L.p7...j.0.~..R...W...T...N.Z..2~...j,..@....3bi.#4.&..&y..d3V.#j...k.,.K...C%...%..s..yj.....7sJK]A..&p.D_17.$^../..).Z"a6"..zd...ZO.Q B..@r.H..1.N.R1.A......)~:?...E. .".#...7xrA4~;.C..1.._....}J.T.&0.j....aL#/.....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-8NPPR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 28 x 35, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):429
                                                                                                                                                                                                                                            Entropy (8bit):6.854308103958898
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7I7PI/kFxNu/V0T0fCKBKkJCPbK1lwEcJz:7PlPoBKaCTK1rcJz
                                                                                                                                                                                                                                            MD5:835A1AC950006E5E0CB1F296BEA85DB0
                                                                                                                                                                                                                                            SHA1:D07388741EED5F29C83802519FC7DB7FE86E8163
                                                                                                                                                                                                                                            SHA-256:C448D3B58A8336780D31CF73F87EA2805B5786A7DB985A48C3B3EE4B4BC4E2C0
                                                                                                                                                                                                                                            SHA-512:5F5EBA5A8EAACBE02A3C01D9E689AB169EAFF9F1C09F0DDB289E92287A809089E72D8ED5E2FDBC16476AB64B66ACB799D4F75B5929A2D08543E8DA5A407ADBA6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......#......!j.....sRGB.........gAMA......a.....pHYs..........(J.....bKGD..............tIME.......@M.9....IDATXGcdX.$.'....E/..,....&..[.......,.......:...n.....0....`3.b!.....".........f&J.R.2.@7.p.......[.AD.....`.YHD.a..zH.!r.Z......V...I..-$'8a..^.|x..a(........!.`.Z./.H....Cb|@./G..I.....?H!M}.e.[..(.4 ..........CX"....P.......l`.../0...jlmm.4...CRR':...Rk.|H{.....q...{>d`..1...o.......IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-9JUHQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 178 x 111, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5886
                                                                                                                                                                                                                                            Entropy (8bit):7.9428678398148485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:9fJTvp2iAJf329FCfsjYsvEG56SyjfEa186J70Lhvxg+NVE:9dvpPA129FC0WSyj06t0LNx3NVE
                                                                                                                                                                                                                                            MD5:5CFF22E5655D267B559261C37A423871
                                                                                                                                                                                                                                            SHA1:B60AE22DFD7843DD1522663A3F46B3E505744B0F
                                                                                                                                                                                                                                            SHA-256:A8D8227B8E97A713E0F1F5DB5286B3DB786B7148C1C8EB3D4BBFE683DC940DB9
                                                                                                                                                                                                                                            SHA-512:E00F5B4A7FA1989382DF800D168871530917FCD99EFCFE4418EF1B7E8473CAEA015F0B252CAC6A982BE93B5D873F4E9ACDB460C8E03AE1C6EEA9C37F84105E50
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......o.....H*......bKGD..............pHYs..........+......tIME......,.<.....IDATx..{.TU~.?.....a.D..F..].....e.-....R....A.*SX[....T.Xn.J.I*..P$.......F..v.F....d...1......?..pO...<....u...w.{......;...8..2Q.f.....1....g.......V...c....J).:#.-.....}..VJA.....<^.7.<b..l...4.l.l..N..$ g.....b.t*.}..V....7g.Y.[).0.,..R.`..;..w-..V....qQ\!.b,%..6..'.*..L.37.<..l_.........Y`6....0...MQ.......5.......H..&z.@.j.(Ol..R.J...f.(.....<.m.j...}5.Owy......c.z|.L..e.{..|i...{]....m..H..3R.E...^..D.u...N...,...K......^C#..>.~.<......r4.\...D.gg..W..5.........u.l...~..&..`-.:8.....X.o..W.dw...8.a....Iw.D.gg'O.S.?~.f.~.=`;p..........f.\....... ..y.....?....a...f..+Gm..WQh..hGX......y..h.f...1....9j\..>xq]...5.......+...ndK./6.K_E....h....K@"..&....8......p....d6.....$....I.C.&..rA.]...<.........f&i.'...P.3-.\.$...|.>..V'kt..<.4..A...X][............PQq.A8../._.dh.\I..O>5.q...q.....].../.z.M kk4*...: /... .....#8..c....ah..>..T..:...ay..l

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-A3HPK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 29 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):363
                                                                                                                                                                                                                                            Entropy (8bit):6.997646592515667
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:6v/lhP2WwlqC19ghmqbMYO3RewQLzM1dVdsgj4TAqK4cOeQPJJEkGKWVp:6v/7WQ2KPPM1VjUAt/laKkGKU
                                                                                                                                                                                                                                            MD5:58967A69295A833A93B30E1A3D03C333
                                                                                                                                                                                                                                            SHA1:B0F984616A3EB0856284D6F5C98415510FB55E7F
                                                                                                                                                                                                                                            SHA-256:3278F339F9A3964D92C1BEF5C4E0A300C9C68587CDDA0F7A82B34FD73B95B409
                                                                                                                                                                                                                                            SHA-512:B1FA11ADB2DEBB9F5595DE056985BD39F9DF5A4F925DCDCFEB24A2BC500376C17FF42BF0644BD158D91C38CDD806C3AF7F2E22D041398EE092FE1C776FF86B85
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............q.6.....bKGD..............pHYs..........+......tIME.....03V.>.....IDATH...J.1......E;.].......x...Fg_.G.../.W.|S._....3h.".....Czv0i..A.!.KB...|Y{..2....../.VjS...'.k.x....v.?.@.U _..T.....\..4?:|LaL..K./8K/.......\...c...^.-p.K...U.s......gK..)...TY^..x.+N.5.........I...&waB.1jY,..'j.Y.b.v.N'?...4....o(J1v..T.....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-BN9ON.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):707
                                                                                                                                                                                                                                            Entropy (8bit):7.4418596058676645
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7GmBjAkh8fjIqLe7yagUPqvMPwE5t7frC1Tt00JETw0jg3Or2ksPd:/mBjAkh8fsqa7W2wEPDov3oQl
                                                                                                                                                                                                                                            MD5:45E0091B87215F768F524DBBEDEDD74E
                                                                                                                                                                                                                                            SHA1:9835B0E117146128C5EED7E43FBE1602C5C1BC23
                                                                                                                                                                                                                                            SHA-256:576467863491FAEDE8053F95BD0C66CF3C273F6B27A05984F81F51AA289191BE
                                                                                                                                                                                                                                            SHA-512:D627E4A81E32542A455A26B775E6CE30580658F4443CB84CF23022ADEC83A315264CE3FAEDD4315A62625843582396B76E994C6C0A91C2C63BB514B05B9ABE6B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME........-.%...PIDATh...1R.0...;?.W@E.".`.@..<.2?....R....4.M&...DCf.cY'..t2.....,..IFP..s...DD.~a.A.;*.......5.H.`... ..........F.....T....|.SQbA..As....` .B....B....810...@.H.......H....+.<.....(...\"B.F..u....]........~^..C7q..k.zp.Lh.p..{z.EG.. #.Z'........ w....c.^9*.!v....3.&.!>-Zp..../.... 7.......O...>.f.*y..3....G.....)=.......+G...... F...G....`.b+.QV..WB0.1.";.....F.~+.?.D..L.p7...j.0.~..R...W...T...N.Z..2~...j,..@....3bi.#4.&..&y..d3V.#j...k.,.K...C%...%..s..yj.....7sJK]A..&p.D_17.$^../..).Z"a6"..zd...ZO.Q B..@r.H..1.N.R1.A......)~:?...E. .".#...7xrA4~;.C..1.._....}J.T.&0.j....aL#/.....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-CPNT7.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 178 x 111, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5886
                                                                                                                                                                                                                                            Entropy (8bit):7.9428678398148485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:9fJTvp2iAJf329FCfsjYsvEG56SyjfEa186J70Lhvxg+NVE:9dvpPA129FC0WSyj06t0LNx3NVE
                                                                                                                                                                                                                                            MD5:5CFF22E5655D267B559261C37A423871
                                                                                                                                                                                                                                            SHA1:B60AE22DFD7843DD1522663A3F46B3E505744B0F
                                                                                                                                                                                                                                            SHA-256:A8D8227B8E97A713E0F1F5DB5286B3DB786B7148C1C8EB3D4BBFE683DC940DB9
                                                                                                                                                                                                                                            SHA-512:E00F5B4A7FA1989382DF800D168871530917FCD99EFCFE4418EF1B7E8473CAEA015F0B252CAC6A982BE93B5D873F4E9ACDB460C8E03AE1C6EEA9C37F84105E50
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......o.....H*......bKGD..............pHYs..........+......tIME......,.<.....IDATx..{.TU~.?.....a.D..F..].....e.-....R....A.*SX[....T.Xn.J.I*..P$.......F..v.F....d...1......?..pO...<....u...w.{......;...8..2Q.f.....1....g.......V...c....J).:#.-.....}..VJA.....<^.7.<b..l...4.l.l..N..$ g.....b.t*.}..V....7g.Y.[).0.,..R.`..;..w-..V....qQ\!.b,%..6..'.*..L.37.<..l_.........Y`6....0...MQ.......5.......H..&z.@.j.(Ol..R.J...f.(.....<.m.j...}5.Owy......c.z|.L..e.{..|i...{]....m..H..3R.E...^..D.u...N...,...K......^C#..>.~.<......r4.\...D.gg..W..5.........u.l...~..&..`-.:8.....X.o..W.dw...8.a....Iw.D.gg'O.S.?~.f.~.=`;p..........f.\....... ..y.....?....a...f..+Gm..WQh..hGX......y..h.f...1....9j\..>xq]...5.......+...ndK./6.K_E....h....K@"..&....8......p....d6.....$....I.C.&..rA.]...<.........f&i.'...P.3-.\.$...|.>..V'kt..<.4..A...X][............PQq.A8../._.dh.\I..O>5.q...q.....].../.z.M kk4*...: /... .....#8..c....ah..>..T..:...ay..l

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-D14CO.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):619
                                                                                                                                                                                                                                            Entropy (8bit):7.419166205831757
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7mDiFdr85Wibc7ez5jD2rSafCbOSVZ/jUHxyZCPpIV7RFvIdhR:DUvibcKztD2rnCqSDgQZApMdFvIdD
                                                                                                                                                                                                                                            MD5:C9A2D0DC2F22EC069650A82E64CEBB71
                                                                                                                                                                                                                                            SHA1:4FCC6F1A04A19B75E64A84943135DACF68488E2F
                                                                                                                                                                                                                                            SHA-256:9EA075327886EA4157DF25A64D9402EC6ACBEF24EE06C1D5DA3AEF96197F26EC
                                                                                                                                                                                                                                            SHA-512:356299EE44CFA760098AF2CB1EDEF250A5DEC285C0338B49A7F37B9B2D661353C4C356FD1FBE586A0C3844A665FE9B1C2DA38C735B6ED26DDCADA68772E47744
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....*........IDATx...Mr.0..`....g....e.\..:.fh.~.,...._.D.mpI:Zk.s>..cD..?....d.`V...fG.D.. . 8....g... ...... `B0..+N.........."!2..(G .."..^.....w ..t ?Fc.....a.}v..2.....6+.Cx.f...\F<.HV.h.....s<.J..7..e....E.W.1h;...++...C..\.}.....Ht..5......y......kL....h2..j.AhQ".J.1.....prY..X...(..~.7Vf.....7#.cC.{O...y...Dt\..i......=C{.e..+e./..J...].T...#.=M..jx......6..{w2}z1sF..q......<Af....M#.vI.k.NE.+.{.Vm....Z..1.H..G+H.J..X...e.ri/H.......>.....d.l.`...0a...-.:..{.P.o.Rn.o6....0.....2.[.&......IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-D3TBF.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):505
                                                                                                                                                                                                                                            Entropy (8bit):7.311302195073986
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7CxmVcG25JcQqCKNaPzPmsI+BRBN3TMj2QQ:5oVDW2+BV37h
                                                                                                                                                                                                                                            MD5:8A33D6B05882AB755DFC9EE9C30526E1
                                                                                                                                                                                                                                            SHA1:FCFF4675AAE6CA1DD1AC67276779E023F33BC7FF
                                                                                                                                                                                                                                            SHA-256:234923BC14F06948F335599612BAE4E7CC422A8F6B8C0DEE34612618874A4149
                                                                                                                                                                                                                                            SHA-512:3FD3A3827DFD409B37FEE63547527A778AF589895D8136279FB3C4940EFB166017951FE5B0E30BCA95D19E57FD63DB38C6D21CF439084492FBC1287820260207
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.........d....IDATH.U1O.@.}_u...d.[.....?...B\]...,n]\.1)1...F..I#..e.D......w.q$.4..}...zWbf....d.h|~..H5...9...i..h.`.:...r"tR..f.=K?..4.I..vO..&0^..W{...t.W%t[ d./...%.......Z..f........<..sw..6v:....8o..R..g...2....J0..c.....^....1..iVUM_.eU.I...s2z..B.....a.......x.....67.Q@..F|..._...;.'...jL.R....jLk...mD.4AuX.%"..h... Vk...F.....i....-c0.R.[FR...lLge.(...-MH^.....=D.q..!..}D......Y..)....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-DEJS7.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):504
                                                                                                                                                                                                                                            Entropy (8bit):7.275571489523102
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7CxvhbFNUklTDVkB8TFMMOdlKKyYxAPG7AfGA4xCrx8Xv:55JN76B8TC5dlKKj7AeAif
                                                                                                                                                                                                                                            MD5:921DB78A66A3136C5866505D07BB29DD
                                                                                                                                                                                                                                            SHA1:B2E64DBE7E6DD9CDFA1590C8E4921796AAC81E7C
                                                                                                                                                                                                                                            SHA-256:62CCDA5C25930E2828891D7278A204DE4D3F35A2C6DA8CA029E9F859E34C4ABC
                                                                                                                                                                                                                                            SHA-512:A0B25C167E3DA1C2992473BDA15D7D10FAC0728421DD2CE27C165B8DB895E7CC349728382437D8F46EB38F0B36594DD0B3F3DC5912CF6FEF6FAB66D919F7CCFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.......\5.....IDATH..1n.@.E...6.Uz."..p.."Q..9.e.%......H.)).%Mr.HH...$.:...l`w=."....._o.....8..5...`.S...~.5......"..9.!..S$("..3..8..4..C.....).....=....,d..d.pK.@2Zs..A.W*....o..I..-.Yk.A.{N..t@9...YKtH&j..%...Z.T.!.=n.~.!......T+.:.:.xV~..3...8..1.c(......;.T*..5w._.x...j.P=..7y......)..B..".)..3..M.+.-7....&!..h.._.|.v...P../.....k....R[.d..iM.j.TM...f..y@.j..U5..>...A...Y......|Y.c.1.A....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-HUJEK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 32 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1603
                                                                                                                                                                                                                                            Entropy (8bit):7.766393035061922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:tOvzUQQyWWYpwUbDBHeNAbVp42j5dMa5H:tWU/yWWYjbDBf4Cv7h
                                                                                                                                                                                                                                            MD5:F6264DDCEA613DC98D253BCB9B1FE484
                                                                                                                                                                                                                                            SHA1:FB85C887F5EF5440FE9837D7A8E578DBDE4DDB8B
                                                                                                                                                                                                                                            SHA-256:283DD43C10FF331011938D962F9B49C4D85D92AC044DC779A9EAE38640FD62DE
                                                                                                                                                                                                                                            SHA-512:CE052311662DBBF39D86963F0ACAA42713735101F15A16839584E1D6EACFB5FDA68381EDCB52F226A14D0B217B95FA4D5AD44186CF4A02830C52EE74CA617F42
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR... ...P.....xXw5....bKGD..............pHYs..........+......tIME......2Z......IDATh..kl.U....-..bk.H"zJ.(1. ..`.......*.4."..T..,..~...`..I5E...J.`J.......(D.....P.....~.,......I6.3s.....{.=wB.X....e.B..x.....|....E...$......6.k}...T.H[F..j.p..PD....Nb......v.O..U...@.2WD~..@U...dN.E.3..T...5%,.|..5%.......Z.x<..u....q=LmM).u.V..X2},..E..^_..r7>.9..v\.5.eS.h...j4..&.....p.cSY..^...w..H.. .~...nT..`EU;.wDYQ.N.r..xe...mS..4T.N.(.Wl./...e.\}..*o..o..p?...S....i~....H._.88...^..v.n.E........z.u.AO....A..y.A[g....w...*c....-....$....t.....Y...O...!v..........@XU.,zjn......S>....m.C(..x.._Uca.AU......x;6b...]H.D..c!h.:...cl..0..u.".H..@D^.HH>.h)F..&CO....I. .....|'......|a1>...;....G.J....K....Uu..)..QN..Gv....a.K[<p3....H.G.V..L...*"..0..Xb.["".B.H.3`..B+Pn8N).&....[..E..j{.e.=..HM..<'.t'.'.."...R\.+.....AD^...Tu.p..4.{..].....S"....Uu4...f)...f.H.g8V.I..,.@DB.c.....Y...o8..%..$M.Tu<p...rY4./._..1AD.'b`#...C....f..R.....F.[}@U.....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-JJD49.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):527
                                                                                                                                                                                                                                            Entropy (8bit):7.318123094870197
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7CxqPIQ2+gvx+GZgCqWeJImCZx93IKOncOD:58DM4CJqWeizhZCcOD
                                                                                                                                                                                                                                            MD5:2D9E64B327D7DA0985A12E7E0A5425F4
                                                                                                                                                                                                                                            SHA1:00C63CA44D76210664A3FAD141E15A9A5A41720C
                                                                                                                                                                                                                                            SHA-256:D6B4699B0F3F69472163785DD20592C8BBB45FFF3843CB75D09CA9AF8AF66CB8
                                                                                                                                                                                                                                            SHA-512:27AFC9ACEC960911193EC1F3E939C5594DB0D0EA40A3590BBC9F24F0A51B1B5391696F9FC66042F2A475F539D7709EB04CEAE8A6741B58A8AE7F076C6D681A4B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME......&...i....IDATH..?N.0...vm#eb..J=@r...:p......=..\.....,p..Jao.H.+...&4..R.......g. ..@R...I..........B.C..B.WHS.Y..!...YP...-..P!....*d..N...i"..0L.....O......_..N.:.....i0...R.@....*..W.K}<../...^..;...j..n.l..u.J.S.^..<.}.t+...$.".q.....td.z}..R....r.r....3.5.(rn1."h.......T.:9........&...5.......0.`.....r..K.*.<. .8.mB2...}...>.6D[B.5.J.^+.......2.....i+.j.VM.3...7..J\..l..|.....O..8........0..Q{:....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-M5LUL.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):179
                                                                                                                                                                                                                                            Entropy (8bit):5.695302062158259
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:yionv//thPlul4fRAadCmy9h/rywOievplxdGt0skV6UhhJnElnbgsrZsYp0rx1p:6v/lhPVfR19ghmFlyOho5gesE0Pp
                                                                                                                                                                                                                                            MD5:036394E78B67C1F5C2E1773B74D148E9
                                                                                                                                                                                                                                            SHA1:3B78B52F1C67BBA12A147BFCB805D6F913E70667
                                                                                                                                                                                                                                            SHA-256:96200DBE8BD64BDF2A85E1FE45FF2169FA08B080425A0F32E4F08A65D83CAB5B
                                                                                                                                                                                                                                            SHA-512:2156BD6E61EA3299F8CB83D9AB1A24062A7AAD743FCED71FBB108AE6F9FC5EBA72843D1619EFA5A9091402631739DDD960C17968B1A4A1027296CECC254C0E65
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME........<.s...@IDAT8.c....?......0p.Y...H.......qE..........YHS....C.f....LG........6....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-N0IB9.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):723
                                                                                                                                                                                                                                            Entropy (8bit):7.502991938803606
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7G1sYhROoOG76OFtzvDM28m4mH8qGjGMXOKvnzAiWbPQK+BQuIlFA4lii:/1sYhRrOUn8AH8NjGMlAhr9iIV
                                                                                                                                                                                                                                            MD5:EEBEE9670CFBE610C723F0FBF219C836
                                                                                                                                                                                                                                            SHA1:35F843D45886AC31773BB437580B5B423923F911
                                                                                                                                                                                                                                            SHA-256:CF3B603A78EAA24C63B082A4CD3936C139CD1885B6D3E60BA58FD47201BD374E
                                                                                                                                                                                                                                            SHA-512:C71AE264BF958A95E741B58BD1BBBE9ED975281EDBD95B25D1C5479E6EDA9C85B4DFC861B7B72B6A566B158E495B12CC835B17A4F5A35B32B6361E0F984BFF65
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME......$...S...`IDATh...MJ.@.........".Bv.....7p..[..v.......,...i5..B......7Ig..43?.3yi'..[...3.........Qb..<x.(...%...@..6.t.k.[.....H...).R.P..(. X'..........Q.Q.@....@S...: 2.l.BU.AY.8*..#v..;.J2v....`.!....4.B....t..X....`>...\.]...4I.......8..<:...Tx.X.0....X./...%p.1.W.A.....e...Nf..ES.....cx..o..0..L..S#.......;0......^.....([.x..kx..j...{p...0.?...0.rL~.6B.`t.nT..+.3.|..].O..$...../Q_..,..$....v......e...)p..|.a........O...%..j[;@. .6=d...y.....aj4lz..C..m.Bij....=W%.6.o.}ETk...m.;..u.#.../I..}.....=T.]u*.2.N U.. .cX.y..a...^l..j...M@.D......a....<UA..$.@..a.......}R.x.$p.W..}...)4[8.q.....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-PAE68.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):652
                                                                                                                                                                                                                                            Entropy (8bit):7.426141389563401
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7mDiFdklN0XVdLVd4tdOEMM018x56ps6zEL1J1lx70xbHYsAZhrljEXJ:DUklNmVdLV+dMM018ys5L15N0xLYhZBm
                                                                                                                                                                                                                                            MD5:BE0368A2650AAFCA0B6935E959BFF614
                                                                                                                                                                                                                                            SHA1:E55B9E3B7B49B04864E2254075385BACB25ACD12
                                                                                                                                                                                                                                            SHA-256:AED337C318176A195EC44E9ACC1D30FB1CC8154FF31F0ACB36DCC57867C50F20
                                                                                                                                                                                                                                            SHA-512:59E81D1EA29321E9BDA950188BBC4B531105B8907757EE7BCB1117724CB321F452D7930800D5E789A9BB9A4E38F1EED84E893123D8277196DA7B04CCDD4E6C64
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....).........IDATx..=s. ...........P....k}.A.....9..... B%.m.V..{!B.HY;?.... .......f................B.."A..J..BH.; .....B..{.'.*(- ..".........7...........^...o:..l 4.9........g.*....y.N...5D!.J......Z..........&........zCmM..R..q..^.9......6.Pa...Al.....m.H<.?.{.x.....D....:.!."I.Z.,.I...g.....j...`$.!.....T..x.*B...J..{.S.m.?T!.}..uT0J.&I;.b/Dk.N..L....*~.@.U.. ..4...k.I.f....B....G. .\.!...!R.b.o+.t..qd.V..#..$.T.......C.Fsth4.!QG..@..f..R.....%.(....eh.........ZH.....je.\.@...B.c.(a....ra/...W93@Iw.7.....`".....E..H&.f....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-SBQPM.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):187
                                                                                                                                                                                                                                            Entropy (8bit):5.975104411893651
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:yionv//thPlg5UwjHTAadCmy9h/rywOia85Fxf1v1JClwBWfxvo4AzsOfdp:6v/lhP+KWHT19ghmIFxRiwBYFfAzswdp
                                                                                                                                                                                                                                            MD5:8BCC2E16763817795E4E81EC86457038
                                                                                                                                                                                                                                            SHA1:050BDB436ADC138D2559D96842A5DD39FA1CF315
                                                                                                                                                                                                                                            SHA-256:CDFC96FBA6EFD3F26C779B4A892AFFFC292D451CC94104C3272B258E17204D07
                                                                                                                                                                                                                                            SHA-512:E992395ABE6F058F3135F5734789C1F4865F865E763BBB10CCE371BCC191E9DD358C1C633C8597601695B73AC008FC864A1AF6920501731E9FCF1C26344ACC22
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............1.5;....bKGD..............pHYs..........+......tIME......%..{....HIDAT..}.... ......tD?&..LM..8....*.:...=/...mVb....U....@.V.".ge.?.~6r...4Nw..!....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\is-VAH19.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):597
                                                                                                                                                                                                                                            Entropy (8bit):7.446044912854569
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7NZFGnsl0cBhl9iF1Qhn9MfpUL7toskF5LGAim0ocq3nwwKKiN:i8slXGF1QhnKKLGi83iN
                                                                                                                                                                                                                                            MD5:8F1AF33632BEB4885863AB973CD781E6
                                                                                                                                                                                                                                            SHA1:547580EBBA11F0E51E68933F4355BBF981B2E306
                                                                                                                                                                                                                                            SHA-256:01698B5F5990658505BEB654446B367D5CCBA0FCA1D893D1C17E79489C379B29
                                                                                                                                                                                                                                            SHA-512:696CF1C9831B2528A6040F1F9DF38CACE6F5B992882F2BC48814EC88834921A558F2F0E55FB9921764A0DF885CC50B9A8D191CC3291903D0A6B58F140BFFAF64
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME......:........IDAT8..KVQ....y.$...!R\.I\.tqqpr...s.@..qs...%0.E......I.....Z..... .Po.y.^.....{......{.sB^.%.f1.W.....50...(.j..p......S5.SI...b..<..lt.6...,...8...u..%]...b..&6....M4...2...`.u0...s..Wlc.....N.E..E..Vr.FR.?.Y..q.... .U...F..I.......Y.op.....y..D......3i..y........,.K. .J..&.Yz..*.M[..........!..I......ld1|i..2.E.a,....S.#y..Y..i.O.....(.b..m..L.|%........1.R..9/....X.Y,&.5.4>..|....m..(o..b......c...=.S.;...N.CH[..^f1..qb<O}.~......'.V._....b.^.t...M..K'.K....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\lock.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):597
                                                                                                                                                                                                                                            Entropy (8bit):7.446044912854569
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7NZFGnsl0cBhl9iF1Qhn9MfpUL7toskF5LGAim0ocq3nwwKKiN:i8slXGF1QhnKKLGi83iN
                                                                                                                                                                                                                                            MD5:8F1AF33632BEB4885863AB973CD781E6
                                                                                                                                                                                                                                            SHA1:547580EBBA11F0E51E68933F4355BBF981B2E306
                                                                                                                                                                                                                                            SHA-256:01698B5F5990658505BEB654446B367D5CCBA0FCA1D893D1C17E79489C379B29
                                                                                                                                                                                                                                            SHA-512:696CF1C9831B2528A6040F1F9DF38CACE6F5B992882F2BC48814EC88834921A558F2F0E55FB9921764A0DF885CC50B9A8D191CC3291903D0A6B58F140BFFAF64
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME......:........IDAT8..KVQ....y.$...!R\.I\.tqqpr...s.@..qs...%0.E......I.....Z..... .Po.y.^.....{......{.sB^.%.f1.W.....50...(.j..p......S5.SI...b..<..lt.6...,...8...u..%]...b..&6....M4...2...`.u0...s..Wlc.....N.E..E..Vr.FR.?.Y..q.... .U...F..I.......Y.op.....y..D......3i..y........,.K. .J..&.Yz..*.M[..........!..I......ld1|i..2.E.a,....S.#y..Y..i.O.....(.b..m..L.|%........1.R..9/....X.Y,&.5.4>..|....m..(o..b......c...=.S.;...N.CH[..^f1..qb<O}.~......'.V._....b.^.t...M..K'.K....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\pausebutton.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):723
                                                                                                                                                                                                                                            Entropy (8bit):7.502991938803606
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7G1sYhROoOG76OFtzvDM28m4mH8qGjGMXOKvnzAiWbPQK+BQuIlFA4lii:/1sYhRrOUn8AH8NjGMlAhr9iIV
                                                                                                                                                                                                                                            MD5:EEBEE9670CFBE610C723F0FBF219C836
                                                                                                                                                                                                                                            SHA1:35F843D45886AC31773BB437580B5B423923F911
                                                                                                                                                                                                                                            SHA-256:CF3B603A78EAA24C63B082A4CD3936C139CD1885B6D3E60BA58FD47201BD374E
                                                                                                                                                                                                                                            SHA-512:C71AE264BF958A95E741B58BD1BBBE9ED975281EDBD95B25D1C5479E6EDA9C85B4DFC861B7B72B6A566B158E495B12CC835B17A4F5A35B32B6361E0F984BFF65
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME......$...S...`IDATh...MJ.@.........".Bv.....7p..[..v.......,...i5..B......7Ig..43?.3yi'..[...3.........Qb..<x.(...%...@..6.t.k.[.....H...).R.P..(. X'..........Q.Q.@....@S...: 2.l.BU.AY.8*..#v..;.J2v....`.!....4.B....t..X....`>...\.]...4I.......8..<:...Tx.X.0....X./...%p.1.W.A.....e...Nf..ES.....cx..o..0..L..S#.......;0......^.....([.x..kx..j...{p...0.?...0.rL~.6B.`t.nT..+.3.|..].O..$...../Q_..,..$....v......e...)p..|.a........O...%..j[;@. .6=d...y.....aj4lz..C..m.Bij....=W%.6.o.}ETk...m.;..u.#.../I..}.....=T.]u*.2.N U.. .cX.y..a...^l..j...M@.D......a....<UA..$.@..a.......}R.x.$p.W..}...)4[8.q.....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\platformenemy.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 29 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):363
                                                                                                                                                                                                                                            Entropy (8bit):6.997646592515667
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:6v/lhP2WwlqC19ghmqbMYO3RewQLzM1dVdsgj4TAqK4cOeQPJJEkGKWVp:6v/7WQ2KPPM1VjUAt/laKkGKU
                                                                                                                                                                                                                                            MD5:58967A69295A833A93B30E1A3D03C333
                                                                                                                                                                                                                                            SHA1:B0F984616A3EB0856284D6F5C98415510FB55E7F
                                                                                                                                                                                                                                            SHA-256:3278F339F9A3964D92C1BEF5C4E0A300C9C68587CDDA0F7A82B34FD73B95B409
                                                                                                                                                                                                                                            SHA-512:B1FA11ADB2DEBB9F5595DE056985BD39F9DF5A4F925DCDCFEB24A2BC500376C17FF42BF0644BD158D91C38CDD806C3AF7F2E22D041398EE092FE1C776FF86B85
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............q.6.....bKGD..............pHYs..........+......tIME.....03V.>.....IDATH...J.1......E;.].......x...Fg_.G.../.W.|S._....3h.".....Czv0i..A.!.KB...|Y{..2....../.VjS...'.k.x....v.?.@.U _..T.....\..4?:|LaL..K./8K/.......\...c...^.-p.K...U.s......gK..)...TY^..x.+N.5.........I...&waB.1jY,..'j.Y.b.v.N'?...4....o(J1v..T.....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\platformplayer.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 32 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1603
                                                                                                                                                                                                                                            Entropy (8bit):7.766393035061922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:tOvzUQQyWWYpwUbDBHeNAbVp42j5dMa5H:tWU/yWWYjbDBf4Cv7h
                                                                                                                                                                                                                                            MD5:F6264DDCEA613DC98D253BCB9B1FE484
                                                                                                                                                                                                                                            SHA1:FB85C887F5EF5440FE9837D7A8E578DBDE4DDB8B
                                                                                                                                                                                                                                            SHA-256:283DD43C10FF331011938D962F9B49C4D85D92AC044DC779A9EAE38640FD62DE
                                                                                                                                                                                                                                            SHA-512:CE052311662DBBF39D86963F0ACAA42713735101F15A16839584E1D6EACFB5FDA68381EDCB52F226A14D0B217B95FA4D5AD44186CF4A02830C52EE74CA617F42
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR... ...P.....xXw5....bKGD..............pHYs..........+......tIME......2Z......IDATh..kl.U....-..bk.H"zJ.(1. ..`.......*.4."..T..,..~...`..I5E...J.`J.......(D.....P.....~.,......I6.3s.....{.=wB.X....e.B..x.....|....E...$......6.k}...T.H[F..j.p..PD....Nb......v.O..U...@.2WD~..@U...dN.E.3..T...5%,.|..5%.......Z.x<..u....q=LmM).u.V..X2},..E..^_..r7>.9..v\.5.eS.h...j4..&.....p.cSY..^...w..H.. .~...nT..`EU;.wDYQ.N.r..xe...mS..4T.N.(.Wl./...e.\}..*o..o..p?...S....i~....H._.88...^..v.n.E........z.u.AO....A..y.A[g....w...*c....-....$....t.....Y...O...!v..........@XU.,zjn......S>....m.C(..x.._Uca.AU......x;6b...]H.D..c!h.:...cl..0..u.".H..@D^.HH>.h)F..&CO....I. .....|'......|a1>...;....G.J....K....Uu..)..QN..Gv....a.K[<p3....H.G.V..L...*"..0..Xb.["".B.H.3`..B+Pn8N).&....[..E..j{.e.=..HM..<'.t'.'.."...R\.+.....AD^...Tu.p..4.{..].....S"....Uu4...f)...f.H.g8V.I..,.@DB.c.....Y...o8..%..$M.Tu<p...rY4./._..1AD.'b`#...C....f..R.....F.[}@U.....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\playership.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 28 x 35, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):429
                                                                                                                                                                                                                                            Entropy (8bit):6.854308103958898
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7I7PI/kFxNu/V0T0fCKBKkJCPbK1lwEcJz:7PlPoBKaCTK1rcJz
                                                                                                                                                                                                                                            MD5:835A1AC950006E5E0CB1F296BEA85DB0
                                                                                                                                                                                                                                            SHA1:D07388741EED5F29C83802519FC7DB7FE86E8163
                                                                                                                                                                                                                                            SHA-256:C448D3B58A8336780D31CF73F87EA2805B5786A7DB985A48C3B3EE4B4BC4E2C0
                                                                                                                                                                                                                                            SHA-512:5F5EBA5A8EAACBE02A3C01D9E689AB169EAFF9F1C09F0DDB289E92287A809089E72D8ED5E2FDBC16476AB64B66ACB799D4F75B5929A2D08543E8DA5A407ADBA6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......#......!j.....sRGB.........gAMA......a.....pHYs..........(J.....bKGD..............tIME.......@M.9....IDATXGcdX.$.'....E/..,....&..[.......,.......:...n.....0....`3.b!.....".........f&J.R.2.@7.p.......[.AD.....`.YHD.a..zH.!r.Z......V...I..-$'8a..^.|x..a(........!.`.Z./.H....Cb|@./G..I.....?H!M}.e.[..(.4 ..........CX"....P.......l`.../0...jlmm.4...CRR':...Rk.|H{.....q...{>d`..1...o.......IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\scoreboard.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 178 x 111, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5886
                                                                                                                                                                                                                                            Entropy (8bit):7.9428678398148485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:9fJTvp2iAJf329FCfsjYsvEG56SyjfEa186J70Lhvxg+NVE:9dvpPA129FC0WSyj06t0LNx3NVE
                                                                                                                                                                                                                                            MD5:5CFF22E5655D267B559261C37A423871
                                                                                                                                                                                                                                            SHA1:B60AE22DFD7843DD1522663A3F46B3E505744B0F
                                                                                                                                                                                                                                            SHA-256:A8D8227B8E97A713E0F1F5DB5286B3DB786B7148C1C8EB3D4BBFE683DC940DB9
                                                                                                                                                                                                                                            SHA-512:E00F5B4A7FA1989382DF800D168871530917FCD99EFCFE4418EF1B7E8473CAEA015F0B252CAC6A982BE93B5D873F4E9ACDB460C8E03AE1C6EEA9C37F84105E50
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......o.....H*......bKGD..............pHYs..........+......tIME......,.<.....IDATx..{.TU~.?.....a.D..F..].....e.-....R....A.*SX[....T.Xn.J.I*..P$.......F..v.F....d...1......?..pO...<....u...w.{......;...8..2Q.f.....1....g.......V...c....J).:#.-.....}..VJA.....<^.7.<b..l...4.l.l..N..$ g.....b.t*.}..V....7g.Y.[).0.,..R.`..;..w-..V....qQ\!.b,%..6..'.*..L.37.<..l_.........Y`6....0...MQ.......5.......H..&z.@.j.(Ol..R.J...f.(.....<.m.j...}5.Owy......c.z|.L..e.{..|i...{]....m..H..3R.E...^..D.u...N...,...K......^C#..>.~.<......r4.\...D.gg..W..5.........u.l...~..&..`-.:8.....X.o..W.dw...8.a....Iw.D.gg'O.S.?~.f.~.=`;p..........f.\....... ..y.....?....a...f..+Gm..WQh..hGX......y..h.f...1....9j\..>xq]...5.......+...ndK./6.K_E....h....K@"..&....8......p....d6.....$....I.C.&..rA.]...<.........f&i.'...P.3-.\.$...|.>..V'kt..<.4..A...X][............PQq.A8../._.dh.\I..O>5.q...q.....].../.z.M kk4*...: /... .....#8..c....ah..>..T..:...ay..l

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\shieldedtarget.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):652
                                                                                                                                                                                                                                            Entropy (8bit):7.426141389563401
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7mDiFdklN0XVdLVd4tdOEMM018x56ps6zEL1J1lx70xbHYsAZhrljEXJ:DUklNmVdLV+dMM018ys5L15N0xLYhZBm
                                                                                                                                                                                                                                            MD5:BE0368A2650AAFCA0B6935E959BFF614
                                                                                                                                                                                                                                            SHA1:E55B9E3B7B49B04864E2254075385BACB25ACD12
                                                                                                                                                                                                                                            SHA-256:AED337C318176A195EC44E9ACC1D30FB1CC8154FF31F0ACB36DCC57867C50F20
                                                                                                                                                                                                                                            SHA-512:59E81D1EA29321E9BDA950188BBC4B531105B8907757EE7BCB1117724CB321F452D7930800D5E789A9BB9A4E38F1EED84E893123D8277196DA7B04CCDD4E6C64
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....).........IDATx..=s. ...........P....k}.A.....9..... B%.m.V..{!B.HY;?.... .......f................B.."A..J..BH.; .....B..{.'.*(- ..".........7...........^...o:..l 4.9........g.*....y.N...5D!.J......Z..........&........zCmM..R..q..^.9......6.Pa...Al.....m.H<.?.{.x.....D....:.!."I.Z.,.I...g.....j...`$.!.....T..x.*B...J..{.S.m.?T!.}..uT0J.&I;.b/Dk.N..L....*~.@.U.. ..4...k.I.f....B....G. .\.!...!R.b.o+.t..qd.V..#..$.T.......C.Fsth4.!QG..@..f..R.....%.(....eh.........ZH.....je.\.@...B.c.(a....ra/...W93@Iw.7.....`".....E..H&.f....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\target.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):619
                                                                                                                                                                                                                                            Entropy (8bit):7.419166205831757
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7mDiFdr85Wibc7ez5jD2rSafCbOSVZ/jUHxyZCPpIV7RFvIdhR:DUvibcKztD2rnCqSDgQZApMdFvIdD
                                                                                                                                                                                                                                            MD5:C9A2D0DC2F22EC069650A82E64CEBB71
                                                                                                                                                                                                                                            SHA1:4FCC6F1A04A19B75E64A84943135DACF68488E2F
                                                                                                                                                                                                                                            SHA-256:9EA075327886EA4157DF25A64D9402EC6ACBEF24EE06C1D5DA3AEF96197F26EC
                                                                                                                                                                                                                                            SHA-512:356299EE44CFA760098AF2CB1EDEF250A5DEC285C0338B49A7F37B9B2D661353C4C356FD1FBE586A0C3844A665FE9B1C2DA38C735B6ED26DDCADA68772E47744
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....*........IDATx...Mr.0..`....g....e.\..:.fh.~.,...._.D.mpI:Zk.s>..cD..?....d.`V...fG.D.. . 8....g... ...... `B0..+N.........."!2..(G .."..^.....w ..t ?Fc.....a.}v..2.....6+.Cx.f...\F<.HV.h.....s<.J..7..e....E.W.1h;...++...C..\.}.....Ht..5......y......kL....h2..j.AhQ".J.1.....prY..X...(..~.7Vf.....7#.cC.{O...y...Dt\..i......=C{.e..+e./..J...].T...#.=M..jx......6..{w2}z1sF..q......<Af....M#.vI.k.NE.+.{.Vm....Z..1.H..G+H.J..X...e.ri/H.......>.....d.l.`...0a...-.:..{.P.o.Rn.o6....0.....2.[.&......IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\xxx.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):505
                                                                                                                                                                                                                                            Entropy (8bit):7.311302195073986
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7CxmVcG25JcQqCKNaPzPmsI+BRBN3TMj2QQ:5oVDW2+BV37h
                                                                                                                                                                                                                                            MD5:8A33D6B05882AB755DFC9EE9C30526E1
                                                                                                                                                                                                                                            SHA1:FCFF4675AAE6CA1DD1AC67276779E023F33BC7FF
                                                                                                                                                                                                                                            SHA-256:234923BC14F06948F335599612BAE4E7CC422A8F6B8C0DEE34612618874A4149
                                                                                                                                                                                                                                            SHA-512:3FD3A3827DFD409B37FEE63547527A778AF589895D8136279FB3C4940EFB166017951FE5B0E30BCA95D19E57FD63DB38C6D21CF439084492FBC1287820260207
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.........d....IDATH.U1O.@.}_u...d.[.....?...B\]...,n]\.1)1...F..I#..e.D......w.q$.4..}...zWbf....d.h|~..H5...9...i..h.`.:...r"tR..f.=K?..4.I..vO..&0^..W{...t.W%t[ d./...%.......Z..f........<..sw..6v:....8o..R..g...2....J0..c.....^....1..iVUM_.eU.I...s2z..B.....a.......x.....67.Q@..F|..._...;.'...jL.R....jLk...mD.4AuX.%"..h... Vk...F.....i....-c0.R.[FR...lLge.(...-MH^.....=D.q..!..}D......Y..)....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\xxx2.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):504
                                                                                                                                                                                                                                            Entropy (8bit):7.275571489523102
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7CxvhbFNUklTDVkB8TFMMOdlKKyYxAPG7AfGA4xCrx8Xv:55JN76B8TC5dlKKj7AeAif
                                                                                                                                                                                                                                            MD5:921DB78A66A3136C5866505D07BB29DD
                                                                                                                                                                                                                                            SHA1:B2E64DBE7E6DD9CDFA1590C8E4921796AAC81E7C
                                                                                                                                                                                                                                            SHA-256:62CCDA5C25930E2828891D7278A204DE4D3F35A2C6DA8CA029E9F859E34C4ABC
                                                                                                                                                                                                                                            SHA-512:A0B25C167E3DA1C2992473BDA15D7D10FAC0728421DD2CE27C165B8DB895E7CC349728382437D8F46EB38F0B36594DD0B3F3DC5912CF6FEF6FAB66D919F7CCFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.......\5.....IDATH..1n.@.E...6.Uz."..p.."Q..9.e.%......H.)).%Mr.HH...$.:...l`w=."....._o.....8..5...`.S...~.5......"..9.!..S$("..3..8..4..C.....).....=....,d..d.pK.@2Zs..A.W*....o..I..-.Yk.A.{N..t@9...YKtH&j..%...Z.T.!.=n.~.!......T+.:.:.xV~..3...8..1.c(......;.T*..5w._.x...j.P=..7y......)..B..".)..3..M.+.-7....&!..h.._.|.v...P../.....k....R[.d..iM.j.TM...f..y@.j..U5..>...A...Y......|Y.c.1.A....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\badassets\xxx3.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):527
                                                                                                                                                                                                                                            Entropy (8bit):7.318123094870197
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:6v/7CxqPIQ2+gvx+GZgCqWeJImCZx93IKOncOD:58DM4CJqWeizhZCcOD
                                                                                                                                                                                                                                            MD5:2D9E64B327D7DA0985A12E7E0A5425F4
                                                                                                                                                                                                                                            SHA1:00C63CA44D76210664A3FAD141E15A9A5A41720C
                                                                                                                                                                                                                                            SHA-256:D6B4699B0F3F69472163785DD20592C8BBB45FFF3843CB75D09CA9AF8AF66CB8
                                                                                                                                                                                                                                            SHA-512:27AFC9ACEC960911193EC1F3E939C5594DB0D0EA40A3590BBC9F24F0A51B1B5391696F9FC66042F2A475F539D7709EB04CEAE8A6741B58A8AE7F076C6D681A4B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME......&...i....IDATH..?N.0...vm#eb..J=@r...:p......=..\.....,p..Jao.H.+...&4..R.......g. ..@R...I..........B.C..B.WHS.Y..!...YP...-..P!....*d..N...i"..0L.....O......_..N.:.....i0...R.@....*..W.K}<../...^..;...j..n.l..u.J.S.^..<.}.t+...$.".q.....td.z}..R....r.r....3.5.(rn1."h.......T.:9........&...5.......0.`.....r..K.*.<. .8.mB2...}...>.6D[B.5.J.^+.......2.....i+.j.VM.3...7..J\..l..|.....O..8........0..Q{:....IEND.B`.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):131480
                                                                                                                                                                                                                                            Entropy (8bit):6.84563405497219
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfrCWV13P1+CUOEvCvOEMI7:BdJPMlMb1g6e0dU9rf3P7UObvOja
                                                                                                                                                                                                                                            MD5:43DAC1F3CA6B48263029B348111E3255
                                                                                                                                                                                                                                            SHA1:9E399FDDC2A256292A07B5C3A16B1C8BDD8DA5C1
                                                                                                                                                                                                                                            SHA-256:148F12445F11A50EFBD23509139BF06A47D453E8514733B5A15868D10CC6E066
                                                                                                                                                                                                                                            SHA-512:6E77A429923B503FC08895995EB8817E36145169C2937DACC2DA92B846F45101846E98191AEB4F0F2F13FFF05D0836AA658F505A04208188278718166C5E3032
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h4h.:.h.h"h.:.h.h%h.:.hN.jh.:.hAh=h.:.h.:.h.:.h.h+h.:.h.h3h.:.h.h0h.:.hRich.:.h........................PE..L...~..S...........!.........h......wd.......@......................................EA....@.........................pr..G....j..P........................g......d....A..............................._..@............@..X............................text....,.......................... ..`.rdata...3...@...4...2..............@..@.data....0...........f..............@....rsrc................|..............@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):144280
                                                                                                                                                                                                                                            Entropy (8bit):6.553148474736184
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Kd3u82FbW5v1B9omLKfBbYWFhFCsfa5z8saPFZ1sL3OD1Ow:Kd+NFbWUMKfBTjFxfa5a1y4N
                                                                                                                                                                                                                                            MD5:0DAF9F07847CCEB0F0760BF5D770B8C1
                                                                                                                                                                                                                                            SHA1:992CC461F67ACEA58A866A78B6EEFB0CBCC3AAA1
                                                                                                                                                                                                                                            SHA-256:A2AC2BA27B0ED9ACC3F0EA1BEF9909A59169BC2EB16C979EF8E736A784BF2FA4
                                                                                                                                                                                                                                            SHA-512:B4DDA28721DE88A372AF39D4DFBA6E612CE06CC443D6A6D636334865A9F8CA555591FB36D9829B54BC0FB27F486D4F216D50F68E1C2DF067439FE8EBBF203B6A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..7...d...d...d..Vd{..d..@d...d..Qd9..d...d...d.Id...d...dq..d.._d...d..Gd...d..Dd...dRich...d........PE..d...p..S.........." .....F...........t.......................................0............@.........................................p...G......P........................g... ..h...0c...............................................`...............................text...fD.......F.................. ..`.rdata...J...`...L...J..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):140696
                                                                                                                                                                                                                                            Entropy (8bit):6.856834819192468
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlERbo3iV8n/7DkCWy:o4YqoZNHi7VBAXvXMZ7ll3iyn3WOR3Oc
                                                                                                                                                                                                                                            MD5:42E2BF4210F8126E3D655218BD2AF2E4
                                                                                                                                                                                                                                            SHA1:78EFCB9138EB0C800451CF2BCC10E92A3ADF5B72
                                                                                                                                                                                                                                            SHA-256:1E30126BADFFFB231A605C6764DD98895208779EF440EA20015AB560263DD288
                                                                                                                                                                                                                                            SHA-512:C985988D0832CE26337F774B160AC369F2957C306A1D82FBBFFE87D9062AE5F3AF3C1209768CD574182669CD4495DBA26B6F1388814C0724A7812218B0B8DC74
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.u...&...&...&.@r&...&.@d&...&.@c&...&=.,&...&2@{&...&...&...&.@m&...&.@u&...&.@v&...&Rich...&........................PE..L...~..S...........!.....@...z......*l.......P......................................x.....@.........................`...G...l...P........................g...........Q.................................@............P..X............................text....>.......@.................. ..`.rdata...E...P...F...D..............@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):149912
                                                                                                                                                                                                                                            Entropy (8bit):6.586184520889439
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:/20T06lYodB6ZcnHgSFulvfV0tYP/ipaQ8PFRBIiOBNOW:1Y6bdB6uHgSwtfV0+P/is1BIpD
                                                                                                                                                                                                                                            MD5:0EAAC872AADC457C87EE995BBF45A9C1
                                                                                                                                                                                                                                            SHA1:5E9E9B98F40424AD5397FC73C13B882D75499D27
                                                                                                                                                                                                                                            SHA-256:6F505CC5973687BBDA1C2D9AC8A635D333F57C12067C54DA7453D9448AB40B8F
                                                                                                                                                                                                                                            SHA-512:164D1E6EF537D44AC4C0FD90D3C708843A74AC2E08FA2B3F0FDD4A180401210847E0F7BB8EC3056F5DC1D5A54D3239C59FB37914CE7742A4C0EB81578657D24B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Pr.P.............As.e....Ae......At.:.....;......Al.........p....Az......Ab......Aa.....Rich............................PE..d...p..S.........." .....Z..........@|.......................................@......b.....@.............................................G.......P.... ...................g...0..h...0s...............................................p...............................text....Y.......Z.................. ..`.rdata...L...p...N...^..............@..@.data....<..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):127384
                                                                                                                                                                                                                                            Entropy (8bit):6.856313478886397
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:yq8Iw0TnMfrUEuKo+w/lT35oBqhSw3kmuqW3Crf0d3N1NsCeOEy6jCMpOEsC:yq8IdTMTyXUR2JJry3NreOnMpOu
                                                                                                                                                                                                                                            MD5:5F1A333671BF167730ED5F70C2C18008
                                                                                                                                                                                                                                            SHA1:C8233BBC6178BA646252C6566789B82A3296CAB5
                                                                                                                                                                                                                                            SHA-256:FD2A2B4FE4504C56347C35F24D566CC0510E81706175395D0A2BA26A013C4DAF
                                                                                                                                                                                                                                            SHA-512:6986D93E680B3776EB5700143FC35D60CA9DBBDF83498F8731C673F9FD77C8699A24A4849DB2A273AA991B8289E4D6C3142BBDE77E11F2FAF603DF43E8FEA105
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h8h.:.h.h.h.:.h.h)h.:.hN.fh.:.hAh1h.:.h.:.h.:.h.h'h.:.h.h?h.:.h.h<h.:.hRich.:.h........................PE..L...}..S...........!.........j......#T.......0......................................r.....@..........................c..b....Z..P........................g......<....1..............................(P..@............0..`............................text............................... ..`.rdata..r4...0...6... ..............@..@.data....0...p.......V..............@....rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):140184
                                                                                                                                                                                                                                            Entropy (8bit):6.5832665674944435
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:6UoPePVhoZB34/UWFdQomnRepTPFn35eoONSO2:j8ZBvWrnmnR2Un+
                                                                                                                                                                                                                                            MD5:61BA5199C4E601FA6340E46BEF0DFF2D
                                                                                                                                                                                                                                            SHA1:7C1A51D6D75B001BA1ACDE2ACB0919B939B392C3
                                                                                                                                                                                                                                            SHA-256:8783F06F7B123E16042BB0AF91FF196B698D3CD2AA930E3EA97CFC553D9FC0F4
                                                                                                                                                                                                                                            SHA-512:8CE180A622A5788BB66C5F3A4ABFDE62C858E86962F29091E9C157753088DDC826C67C51FF26567BFE2B75737897F14E6BB17EC89F52B525F6577097F1647D31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.k6...e...e...e...e{..e...e...e...e9..e...e...e..e...e...es..e...e...e...e...e...e...eRich...e........PE..d...p..S.........." .....4...........b....................................... .......1....@......................................... ...b...D...P........................g......h...@S...............................................P...............................text....2.......4.................. ..`.rdata...L...P...N...8..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\celua.txt (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (520), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):215333
                                                                                                                                                                                                                                            Entropy (8bit):4.786182096058482
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:VcIxsXTXvMeRTWJANaOOwubWiSe65oCmL/+5y/McvJVNry++Ctso2NwVWy+cOcEV:JLSRgun
                                                                                                                                                                                                                                            MD5:924416232DF99AEF96A2D9E8125AFE78
                                                                                                                                                                                                                                            SHA1:7F29A338CEFA00BE5FCDC8B94C41FFC31EE625B9
                                                                                                                                                                                                                                            SHA-256:77C6D324F03A8429BCE858824CFFFCFB7A50D39616D2F9D2729910E086F5AD9A
                                                                                                                                                                                                                                            SHA-512:470C55E302C86353584EEABB3510B4EFF6353ED16F549DB7C155B2C8283216F2B413D77C9FE20A12F6F55A07C9BE24614DF3A8F5B2CABF1597010249239D63F5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:List of CE specific functions and variables:....Global Variables:..TrainerOrigin : A variable that contains the path of the trainer that launched cheat engine (Only set when launched as a trainer)..process : A variable that contains the main modulename of the currently opened process..MainForm: The main ce gui..AddressList: The address list of the main ce gui......Global Functions:..getCEVersion(): Returns a floating point value specifying the version of cheat engine..getCheatEngineFileVersion(): Returns the full version data of the cheat engine version. A raw integer, and a table containing major, minor, release and build....getOperatingSystem(): Returns 0 if CE is running in Windows, 1 for Mac....darkMode(): Returns true if CE is running in windows Dark Mode. Has no effect on mac....activateProtection(): Prevents basic memory scanners from opening the cheat engine process (Not that useful)..enableDRM(altitude OPTIONAL, secondaryprocessid OPTIONAL ) : Prevents normal memory scanners f

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\ceregreset.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):309664
                                                                                                                                                                                                                                            Entropy (8bit):5.8237432164000404
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:TDwf7I4zq0ZDVQ5uIqp5rkenPajp80Gc5:T0f7Bz/G5uImQaPajp3
                                                                                                                                                                                                                                            MD5:59089C96334966EDFFC70BF4AE829910
                                                                                                                                                                                                                                            SHA1:8DC37D6F2364749D52DB1BCB9AD9FE30FB93930D
                                                                                                                                                                                                                                            SHA-256:49A55638C5A0F8112B89C45A24A2BCD102FF5DE2D22386649D7F6FFD283AF1FD
                                                                                                                                                                                                                                            SHA-512:3EDD411905298FDE78DF57B063B4B2000FA2D16F0E1A14E8940D4FBC2226C1CBA6925C47D3BECC10E76BBA9C5864CF671F5EF3B29CFA430823D0FA9BF9BBC3A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................e.......).. .............@.........................................................................`..d....p...............N...k......|...........................P........................b...............................text....e.......f.................. ..`.data................j..............@....rdata...~..........................@..@.bss.....)... ...........................CRT.........P......................@....idata.......`......................@....rsrc........p......................@....reloc..|........0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12807608
                                                                                                                                                                                                                                            Entropy (8bit):6.604078603198481
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:393216:ueBcnBaXXA3MnU+239JmqUKSw6knnbWUuMu25s8U:uis/c2GF
                                                                                                                                                                                                                                            MD5:5BE6A65F186CF219FA25BDD261616300
                                                                                                                                                                                                                                            SHA1:B5D5AE2477653ABD03B56D1C536C9A2A5C5F7487
                                                                                                                                                                                                                                            SHA-256:274E91A91A7A520F76C8E854DC42F96484AF2D69277312D861071BDE5A91991C
                                                                                                                                                                                                                                            SHA-512:69634D85F66127999EA4914A93B3B7C90BC8C8FAB1B458CFA6F21AB0216D1DACC50976354F7F010BB31C5873CC2D2C30B4A715397FB0E9E01A5233C2521E7716
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................./......&h..t...q...<.......@h...@.................................$........................................P...........................k..................................P@h......................\..L............................text....&h......(h................. ..`.data....t...@h..v...,h.............@....rdata..X.B...u...B...u.............@..@.bss.....q...............................CRT.........@......................@....idata...H...P...J..................@....rsrc............ .................@.../4..................................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe.sig (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.551821770808043
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:SNjBeQx+FGOujzBAk+skvy2a4nfJKnBTa6C:+jkk+dsAk+Fzag+BTab
                                                                                                                                                                                                                                            MD5:ADAFB7CDCA51FC803718F25172652DD3
                                                                                                                                                                                                                                            SHA1:DD882B60A842B0992F478349898415A857934330
                                                                                                                                                                                                                                            SHA-256:B1B61B2570DBAF2747C4862B8429424514D300A7E14B5065C8BBB4B751179E7E
                                                                                                                                                                                                                                            SHA-512:D0B3D17F0F1EFB8F2F0BCAA1295AED08043F0218BCFA092A47D46308911EC4BC2441711CAB300B852DE3DBCED1C83536750B1A77A75EAE5C8CBF95991AA88714
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.CaG.(9......q.5..4S..%..+...U*.>{5.......M.....-..kF.....7.."z..W.Lc...."6/.V.N..p.YC?...:m.D.k.T....u.0...c.U.h...\;1`.`B..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16708024
                                                                                                                                                                                                                                            Entropy (8bit):6.11289505731243
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:H/KthjnNWKtC5bqOrXSFjmnIQGQCW/4PRtYRN3Ticx8cP:fKthjnNWKtC5bqOrXSjmnxGQaTdy8c
                                                                                                                                                                                                                                            MD5:910DE25BD63B5DA521FC0B598920C4EC
                                                                                                                                                                                                                                            SHA1:94A15930AAF99F12B349BE80924857673CDC8566
                                                                                                                                                                                                                                            SHA-256:8CAEF5000B57BCA014EF33E962DF4FCA21AEAD0664892724674619EF732440AD
                                                                                                                                                                                                                                            SHA-512:6FF910BB4912FEA1FA8FD91E47AE6348C8BF2EFF4F2F5F9EF646A775CA1ECFEF02C23F81BAF6FE2D0B0BDDA7617D91DF52E75DC6063E86EA0444B0538CBD4E6C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{.....@....=........@......................................!.......................................................P...............p..L........k..................................p.{.(....................i..H............................text.....{.......{................. ..`.data.........{.......{.............@....rdata...qa......ra................@..@.pdata..L....p.......F..............@..@.bss....@....0...........................CRT.........@......................@....idata...b...P...d..................@....rsrc............ ...d..............@.../4......(...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe.sig (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.561254441246199
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:OP/KrtviZQl8kimG0bj/xeRBtjajKdp2tAdNQL6aj:8/XQl823j5eRBtOjK2tGNe6aj
                                                                                                                                                                                                                                            MD5:735EAEA06DAE6CD67680127419FBA366
                                                                                                                                                                                                                                            SHA1:A38126141A4266CDBA17B22CBC4588D88CCFCEB5
                                                                                                                                                                                                                                            SHA-256:5A2D3E0F10E3701DFB251C3F270B00493CEAD1C3D1CEB34FF976D70C57DC1B58
                                                                                                                                                                                                                                            SHA-512:92374BDC99BDDDCC2A8B74049B9FF1623EE03B505BA2607E31301F95F2DF8EF3513ECAD4491E2B6B61934F64816E3E9AD3FA3B0914E96D6E55A4B4DF4ED5E028
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:.....s.....N..-.........YI .....L.`0......H...Ko.Y....f....Z.pe....... ..)..3.Go...F..s.U.C....{../._U.}|.."*x..z..bn.D.>;....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16718264
                                                                                                                                                                                                                                            Entropy (8bit):6.110071636301838
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:393216:sjcp4nsiRMX7ZbqE14ImAfltGYav/HX8h:bbqE1RmLvvY
                                                                                                                                                                                                                                            MD5:EDEEF697CBF212B5ECFCD9C1D9A8803D
                                                                                                                                                                                                                                            SHA1:E90585899AE4B4385A6D0BF43C516C122E7883E2
                                                                                                                                                                                                                                            SHA-256:AC9BCC7813C0063BDCD36D8E4E79A59B22F6E95C2D74C65A4249C7D5319AE3F6
                                                                                                                                                                                                                                            SHA-512:1AAA8FC2F9FAFECBE88ABF07FBC97DC03A7C68CC1D870513E921BF3CAEAA97128583293BF5078A69AECBB93BF1E531605B36BD756984DB8D703784627D1877D1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{..........=........@......................................e.......................................................p...........................k..................................p.|.(.......................H............................text.....{.......{................. ..`.data.........|.......{.............@....rdata...xa......za................@..@.pdata...............n..............@..@.bss.........P...........................CRT.........`.......&..............@....idata...b...p...d...(..............@....rsrc............ ..................@.../4..................................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe.sig (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.608714005689305
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:/toxN4m4GbUss7S2tY1wnwi9DU4liplagVMlWqOUFgaUSR708:Lm4GbnkSHunwlaiplNmlVOUaar08
                                                                                                                                                                                                                                            MD5:FE5E5B8B50F441DD772BFA1996AC744E
                                                                                                                                                                                                                                            SHA1:11D00533ADE98E94C7C6609F4E4B002A94CB440C
                                                                                                                                                                                                                                            SHA-256:A769BC72C97106722BF5CE8D76AFDC3EC54FC38931872B0637D8B7A281FFFE22
                                                                                                                                                                                                                                            SHA-512:559FB92A2C58B84AC1CDA6115AA175B0285EA98903EB1F6C91E3A0ECF39F6D667711F97D0EFF8CD98BA25256EC7B339E38D892A90186DB482587E1A80462A6EB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.^..'....'..d.]-+4.].....Q..m...bs...w.M.kTBU..5C...e.....].a..0.N+rF^.-..\......f...B).#H......XM....Ej`.q....I.3p...p:.(.Y

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\clibs32\is-B30AF.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109568
                                                                                                                                                                                                                                            Entropy (8bit):6.474745502920158
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:3jVqSAqTNsYdNB3XT8le/lqWG3v0ESpz7cv+qsWjcd4JJ:3jgYd3T88Up/0wu+J
                                                                                                                                                                                                                                            MD5:B0A3CB1FC2B5195842E8BF12FD9B87F4
                                                                                                                                                                                                                                            SHA1:EDC423C35A48EFFC139A224C10D1EDDE42B31BCE
                                                                                                                                                                                                                                            SHA-256:D39677CF84E33E4A55494D0AB4873B9F3BE16F83AD381B72B14D6C62CEF71518
                                                                                                                                                                                                                                            SHA-512:B93B073021DD63E4383CC2370D003CA058236A3E0860E034515EA894F6995B0ED4F198CB471CB2A5E0BF4330A4D84FBDA254C5A6F367781CD4A47B9C16D9371D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.!...!...!...se..!...s[..!...sd.?!..|.O..!...XY..!...!..'!....`..!....X..!...s_..!....Z..!..Rich.!..........................PE..L...b9/V...........!.....$..........84.......@............................................@.............................F...(...<...................................0B..8...........................x...@............@...............................text...{".......$.................. ..`.rdata...X...@...Z...(..............@..@.data....2..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\clibs32\lfs.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):109568
                                                                                                                                                                                                                                            Entropy (8bit):6.474745502920158
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:3jVqSAqTNsYdNB3XT8le/lqWG3v0ESpz7cv+qsWjcd4JJ:3jgYd3T88Up/0wu+J
                                                                                                                                                                                                                                            MD5:B0A3CB1FC2B5195842E8BF12FD9B87F4
                                                                                                                                                                                                                                            SHA1:EDC423C35A48EFFC139A224C10D1EDDE42B31BCE
                                                                                                                                                                                                                                            SHA-256:D39677CF84E33E4A55494D0AB4873B9F3BE16F83AD381B72B14D6C62CEF71518
                                                                                                                                                                                                                                            SHA-512:B93B073021DD63E4383CC2370D003CA058236A3E0860E034515EA894F6995B0ED4F198CB471CB2A5E0BF4330A4D84FBDA254C5A6F367781CD4A47B9C16D9371D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.!...!...!...se..!...s[..!...sd.?!..|.O..!...XY..!...!..'!....`..!....X..!...s_..!....Z..!..Rich.!..........................PE..L...b9/V...........!.....$..........84.......@............................................@.............................F...(...<...................................0B..8...........................x...@............@...............................text...{".......$.................. ..`.rdata...X...@...Z...(..............@..@.data....2..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\clibs64\is-K8UEV.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):128000
                                                                                                                                                                                                                                            Entropy (8bit):6.022352271630432
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:BzlRkrowTiYa0u6lQUf3V/4MSfayysXZzjGRobJy:BRylTHa+/yMByyupY
                                                                                                                                                                                                                                            MD5:5E8AD34FF069B6A2E1AE00BDFE96B612
                                                                                                                                                                                                                                            SHA1:3C83AA3EBD95D9A060ED1F06E236E046C6CD93A7
                                                                                                                                                                                                                                            SHA-256:4EE8D3375F2EEB8E5AFB230D13C2CF9EE0379B0EDFA76AD8DBF5EBC686A629C1
                                                                                                                                                                                                                                            SHA-512:54404199C3B5B3597DC8FB5A6E3C6772F2729045AA5C9AEE648C4306358481DEF2BC15538899AB5E0F5E33D202CEC863348830A090B144E00D1662CCF4175828
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dr[. .5. .5. .5.fB...5.fB...5.fB.).5.....".5.]j.#.5. .4...5....!.5....!.5.-A.!.5....!.5.Rich .5.........PE..d...\9/V.........." .....<...........7.......................................@............`.............................................F.......<.... .......................0......`T..8...........................@...p............P...............................text...p:.......<.................. ..`.rdata...~...P.......@..............@..@.data...p=..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):128000
                                                                                                                                                                                                                                            Entropy (8bit):6.022352271630432
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:BzlRkrowTiYa0u6lQUf3V/4MSfayysXZzjGRobJy:BRylTHa+/yMByyupY
                                                                                                                                                                                                                                            MD5:5E8AD34FF069B6A2E1AE00BDFE96B612
                                                                                                                                                                                                                                            SHA1:3C83AA3EBD95D9A060ED1F06E236E046C6CD93A7
                                                                                                                                                                                                                                            SHA-256:4EE8D3375F2EEB8E5AFB230D13C2CF9EE0379B0EDFA76AD8DBF5EBC686A629C1
                                                                                                                                                                                                                                            SHA-512:54404199C3B5B3597DC8FB5A6E3C6772F2729045AA5C9AEE648C4306358481DEF2BC15538899AB5E0F5E33D202CEC863348830A090B144E00D1662CCF4175828
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dr[. .5. .5. .5.fB...5.fB...5.fB.).5.....".5.]j.#.5. .4...5....!.5....!.5.-A.!.5....!.5.Rich .5.........PE..d...\9/V.........." .....<...........7.......................................@............`.............................................F.......<.... .......................0......`T..8...........................@...p............P...............................text...p:.......<.................. ..`.rdata...~...P.......@..............@..@.data...p=..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\commonmodulelist.txt (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1882
                                                                                                                                                                                                                                            Entropy (8bit):4.658116184932645
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:60wIlJhxWXs/2h8OjrGCLyO7OjO6NsVhVyQk7FUBL9HuTsx0refVS+IsZZsznGd2:HTP8gE8OvnKy6NsVu7FYLswlW/
                                                                                                                                                                                                                                            MD5:CC0F8B66BFEDC67DA8DBB2A7DF2AA006
                                                                                                                                                                                                                                            SHA1:C6D86CC43A042581E389DC9A28AFFDDF64294AC8
                                                                                                                                                                                                                                            SHA-256:CDDD0F35F7351E6F19486CCD7EEE5D31F0134C5C3554A12C7D51131DDE8E29CD
                                                                                                                                                                                                                                            SHA-512:A4AEC40AC6BEA2ADACF15829AEEEBE66117473A542303024669A828710C6AFD072C0F4890A6A334B35AC894A1A80A5BDD5E91A6FFCB7149540E304117A7E5800
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#write down modulenames that are commonly used by games..#this decreases the number of wrong results in various types of memory inspection....1911.dll..speedtreert.dll..visionengineplugin.vplugin..vision90.dll..vbase90.dll..nvscpapi.dll..physxcore.dll #nvidia physx..nxcooking.dll..physxloader.dll..physxextensions.dll..cudart.dll..openal32.dll..vorbisfile.dll..ogg.dll..vorbis.dll..vorbisenc.dll..vorbisfile.dll..binkw32.dll..bink2w64.dll..iconv.dll..gameoverlayrenderer.dll #steam..steam_api.dll..steam_api64.dll..steamclient.dll..steamclient64.dll..tier0_s.dll..vstdlib_s.dll..steam.dll..steam2.dll..mss32.dll..dbghelp.dll..umbra.dll..unrar.dll....#CE dll's..cehook.dll..allochook.dll..allochook-x86_64.dll..allochook-i386.dll..vehdebug-i386.dll..vehdebug-x86_64.dll..speedhack-i386.dll..speedhack-x86_64.dll..luaclient-i386.dll..luaclient-x86_64.dll..d3dhook.dll..d3dhook64.dll..ced3d9hook.dll..ced3d9hook64.dll..ced3d10hook.dll..ced3d10hook64.dll..ced3d11hook.dll..ced3d11hook64.dll..luaclient-

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\d3dhook.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):122776
                                                                                                                                                                                                                                            Entropy (8bit):6.859839225631497
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:QyfNvGKKZVGcuasOKQBBTff07PSZHCSVKOCDCA32XQaOCKnOEPChMOE6:lNvG7vGcIiBTMS18RD7325YO/hMOr
                                                                                                                                                                                                                                            MD5:2A2EBE526ACE7EEA5D58E416783D9087
                                                                                                                                                                                                                                            SHA1:5DABE0F7586F351ADDC8AFC5585EE9F70C99E6C4
                                                                                                                                                                                                                                            SHA-256:E2A7DF4C380667431F4443D5E5FC43964B76C8FCB9CF4C7DB921C4140B225B42
                                                                                                                                                                                                                                            SHA-512:94ED0038068ABDDD108F880DF23422E21F9808CE04A0D14299AACC5D573521F52626C0C2752B314CDA976F64DE52C4D5BCAC0158B37D43AFB9BC345F31FDBBC0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h...h...h...:U..h...:D..h...:R..h..|....h...h...h...:[..h...:@..h..Rich.h..........PE..L...}..S...........!.........j.......K....... .......................................d....@..................................L..<....................x...g...........!..............................XB..@............ ..|............................text............................... ..`.rdata...5... ...6..................@..@.data...<0...`.......D..............@....rsrc................X..............@..@.reloc..h............Z..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\d3dhook64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):135064
                                                                                                                                                                                                                                            Entropy (8bit):6.612681349758152
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:ZGrrgbU27p/nFdpF/vwFLUjh2v5VjObfSVMPFtE8PdYO3kOc:crk3ZFdpRYUjh2verh6
                                                                                                                                                                                                                                            MD5:2AF7AFE35AB4825E58F43434F5AE9A0F
                                                                                                                                                                                                                                            SHA1:B67C51CAD09B236AE859A77D0807669283D6342F
                                                                                                                                                                                                                                            SHA-256:7D82694094C1BBC586E554FA87A4B1ED6EBC9EB14902FD429824DCD501339722
                                                                                                                                                                                                                                            SHA-512:23B7C6DB0CB9C918AD9F28FA0E4E683C7E2495E89A136B75B7E1BE6380591DA61B6FB4F7248191F28FD3D80C4A391744A96434B4AB96B9531B5EBB0EC970B9D0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........nV..............................*%..........................Rich............PE..d...p..S.........." .....&...~......0\...............................................8....@.................................................l...<........................g......$....C...............................................@...............................text....%.......&.................. ..`.rdata..~K...@...L...*..............@..@.data....;...........v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\dbk32.cepack (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46468
                                                                                                                                                                                                                                            Entropy (8bit):7.994038510231404
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:knKJWrjSpYCoxMO0HqzZuCxbSbONOirgFENxbWUYfQsQB/ju9x0QhS5d7uuNMRgH:knKJorQO0KcFigi841WUYfQhju9x0OcF
                                                                                                                                                                                                                                            MD5:715D61B9BCC484E271775F36865A4CDE
                                                                                                                                                                                                                                            SHA1:8AE158AEF6F6005AA3D6E6F8A09A05FD95551784
                                                                                                                                                                                                                                            SHA-256:C4B5797588C80520745732B96D7C6681F8420BDF55E426C40B852E56E5630124
                                                                                                                                                                                                                                            SHA-512:5C8E462FA504AC91D928617C74E287B598CE326A323C8A05533D4245D018A4A4CC354D05A0568785E7642D8CF779805950D70FE167C456B2D15F8901D714C037
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:CEPACK0:....|T..?~7..,...0.(....%........%.DL...uAE.....7...k...,..c[.........I.....Bk.y..........=..n6.}.......Wf.33g..9s..[r.V!U..#9E.........?...^.&.2..c....y.b...9..<..5?x(...<..#.....Y.x8...s..t.<......:d....K~.......O_....J...Q.S.y.o.m........^....F..G..s.A....D.E.......0.&...w....R...aV^.'.r_E?Vr.Z-.=E....K..j.].^i.4..Q.#"n.x.Y.....*.l.r... ..N9.......7...m.U...o....~z........I.9. NY........N.....Q...=..bP......w..o(.P.a...7.o..V=B.Pv..I..o..-......1.sp.P(x........M...~-.......R.N7...P.o..:....0)...+.Rq.(../....L.O.e.......^..8'.{"..!.=R.\...|.o.. ..U.c.5-.~g.S..3.A....p..+.#JC.....j..;.1S... ..STX.`y...Z....f.d....SI..Q....(P|d....l0....<{...0{.r..*Pr}..*.BE....{...2/;....H..kg.o....r<j.K3.S.U.e>X.<...c.4.d7/.`....k....YV.zU........).GO....Y.x....[.9.p...q.........G...7z.....y.......a.El.*F9&...[3...XF.P.<l.rU.o.C.a.4w..jI.UeU.tUi.....*.0.O..~J..^.a.M%VzwZ.*..U.WU$..qMU..h.\..MU...A.....1<...-......'...gG.U6!X.M.s

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\dbk64.cepack (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):55173
                                                                                                                                                                                                                                            Entropy (8bit):7.995644990698608
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:1536:aPQbr8Hv6jZwnB8K5vHTcM2b9+lmFD/cEt1kbD5F:Tbr8Hv6ji75vHTx9kD/cquP
                                                                                                                                                                                                                                            MD5:3885F7AF9007DF5A9874E61EDBB45F58
                                                                                                                                                                                                                                            SHA1:F7A7719E5A9036604CC64922FF2DC4FD40D253DD
                                                                                                                                                                                                                                            SHA-256:52EAA08C57AA0BA9737ED4413786DAB747DF4C692F34BF601D4FB0B37F231D08
                                                                                                                                                                                                                                            SHA-512:CAFF16F4171D205A1B44B18651FBA7B72D33F7FDD657C5EBA44853B26929B3F48749D9C5B07F158EA903D41C09A905D27D0A4E3D7B6228550B8C255FC64D5A3D
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:CEPACK.....{|SE.8~o...4$"..."...JQ.P.Z..[.*j}.E.VE..j]A[[.1........oD..)E[\.........1..."".....4e..........;....3g.9.V-O.47<..i./.........b..B...i....gB.EW.k....+'_..2....../.......E...N9=x..S.....D..>...W...g......Wr)../.s....C...}=..6.b.s[..~.?y...w.........i.M..t{.B..6..>.../W...0..k._;.*.........4.&.].....G....E.y....t....O..Wmj.K.P..ti...e...X`...I..k%;.3u....ow..D..E...:.h..D..E...r...dM.{WNS...%z...y..i...?5:..V.....F.:B]...=.gz.O.?..l.F.@.=G.....\9m..S4n.h+.wF........l..6[..W..f*........*....W..pr]X..z+..t:.......5;......a.Y.u..R.{..f......X4Tx....o2..._.1o........d7.....g.......~.....XG_.._1c....}.......|.........*0.u....-.u..N.*.y=.~..:x5..C.k....j.A.HIuQ4...cZ./.6}.X........;.:5.....0?.N.*`....x.......l..w...BEf|F..GC.h....oe....V2..B.Y...b......'.....*.q$6..k.7@M1x...i..o.Y.M....N+.N.1..x.~.r...............Qa...a..].p...._....d..$L....g..Nn.SQ[.......Mb..b|y...}....%v1....D].,Jji..(Q.h..M..G.q...[B.h.j.y`

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\defines.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12502
                                                                                                                                                                                                                                            Entropy (8bit):5.40558493486102
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:0egHuderGTd4G9mSZk/8fdtINfbLmJFcSC5xm+9qh07EBS5pekFrLUK80u9ETxst:AHuderlSZk/8FtIF4umMqEpDg3fT
                                                                                                                                                                                                                                            MD5:62E1FA241D417668F7C5DA6E4009A5A6
                                                                                                                                                                                                                                            SHA1:F887409E3C204A87731F317A999DC7E4CC8D3FCD
                                                                                                                                                                                                                                            SHA-256:82E8EF7DF20A86791CEF062F2DCACB1D91B4ADC9F5DEA2FD274886BE8365B2F8
                                                                                                                                                                                                                                            SHA-512:2283CBB9E1D5D53AD1ED9BC9DB6034FB3C53C633B11001F373523640BBBBA95DA9A3A0866C7D5FA0620FACAB7D18C8577DFD69496FC7319E0A4A74D0B9E10C45
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Defines:....--checkbox state defines..cbUnchecked=0..cbChecked=1..cbGrayed=2......--onMouseEvent button defines:..mbLeft=0..mbRight=1..mbMiddle=2..mbExtra1=3..mbExtra2=4......--memo scrollbar defines..ssNone=0..ssHorizontal=1..ssVertical=2..ssBoth=3..ssAutoHorizontal=4..ssAutoVertical=5..ssAutoBoth=6......bsNone=0..bsSingle=1..bsSizeable=2..bsDialog=3..bsToolWindow=4..bsSizeToolWin=5........--scan types: (fast scan methods)..fsmNotAligned=0..fsmAligned=1..fsmLastDigits=2....--rounding types..rtRounded=0..rtExtremerounded=1..rtTruncated=2....--scan options..soUnknownValue=0..soExactValue=1..soValueBetween=2..soBiggerThan=3..soSmallerThan=4..soIncreasedValue=5..soIncreasedValueBy=6..soDecreasedValue=7..soDecreasedValueBy=8..soChanged=9..soUnchanged=10......--debug variables..--Breakpoint methods:..bpmInt3=0..bpmDebugRegister=1..bpmException=2......--Breakpoint triggers:..bptExecute=0..bptAccess=1..bptWrite=2....--breakpoint continue methods:..co_run=0..co_stepinto=1..co_stepover=2....-

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\donottrace.txt (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):104
                                                                                                                                                                                                                                            Entropy (8bit):4.292808527787486
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:VSPAiQ7UeSaClo+tHEu3jdXgOYsO:Vr7Ueyl4u3jdQOS
                                                                                                                                                                                                                                            MD5:A2E60A2F01F69D0DA415C58F25C37E5B
                                                                                                                                                                                                                                            SHA1:FA1A0D6183FEE10DE5FA4C554370556217E3AF26
                                                                                                                                                                                                                                            SHA-256:DC9354CCF9667D1E5CA13D6468BA2C258256042D7C25E6D91ADE7F8E2A2FF3BF
                                                                                                                                                                                                                                            SHA-512:CE7F5F8365D2EF3DA14D4123CC7EF053A7F99E8F98D47E6C5967F267B8EC7FDAC2DA993D0FC26DF8EB2FACE176BA56B7359BA1F29F021E1DFDD561B15EFE64AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#Enter modulenames you do not wish to trace..#kernel32.dll #example. comment out to ignore kernel32.dll

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\gtutorial-i386.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3208608
                                                                                                                                                                                                                                            Entropy (8bit):6.4378051911330445
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:itwSHCeicAlYJhPx7Ur4+Kn8KTqeUrncXbvTCeVxkg8vL5V2zRkit6bch6WuDgR1:itwAf64swnNmnfsR3ccJkKSib
                                                                                                                                                                                                                                            MD5:0D4BDC37F5031A827B2877770974FE49
                                                                                                                                                                                                                                            SHA1:7D7D63F1CC49FB94D2FD59AF8A0BA89966CE0E07
                                                                                                                                                                                                                                            SHA-256:F3C536EC5307D71260FA5D6D70AC56A20A00DBC3FB785E0DEB4EF0F7DC66FC2E
                                                                                                                                                                                                                                            SHA-512:D1FAF9BCF6BBF6E458780F4D913BA600A5F987FF33BE8D24A1165F5BFA925B2D1DFFDAA6E666712D09D58478174BC2956877A4A60376F7773D1E818BB38A23E1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........................d...D....-.......0....@..........................@1.......1.......................................-...... ................0..k..................................P0......................8.-.\............................text............................... ..`.data...d....0......................@....rdata...=... %..>....%.............@..@.bss....D....`-..........................CRT..........-......F-.............@....idata.../....-..0...H-.............@....rsrc........ .......x-.............@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\gtutorial-x86_64.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4210080
                                                                                                                                                                                                                                            Entropy (8bit):6.041283402178925
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:aMiOO5AqojVbq2s2Kyvzq/9E3piKR+77v5WiESldKtyQ6WuDgRPOjgy+OSijV:aMiOOaBbq2VVvnlykESip
                                                                                                                                                                                                                                            MD5:AEC662CEAE2C4D5ABAEEEE084D828582
                                                                                                                                                                                                                                            SHA1:A57CEB95E3FD3F8E8C59C0B7E913E2681B64751D
                                                                                                                                                                                                                                            SHA-256:2DD35A044D1291D593F1DA15C40FD124DA3E4D52D0D045EC61465B725E58079D
                                                                                                                                                                                                                                            SHA-512:FF28EB79795A6D4AD97A5C79CEB5314208C616BE7CC9196622B9BB2AB8149C6CAA166EED6165923DC8FA253A400422CBEE9E061E72DCF61CE66C700D1451AE7A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......#..m......-........................................@...... A......................................................@=.......=......0:.Ta....?..k..................................p.$.(....................O=..............................text.....#.......#................. ..`.data....m....$..n....#.............@....rdata.......p*......b*.............@..@.pdata..Ta...0:..b....:.............@..@.bss.........<..........................CRT.........0=......~<.............@....idata..@>...@=..@....<.............@....rsrc.........=.......<.............@...................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\_mingw.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3865
                                                                                                                                                                                                                                            Entropy (8bit):5.239566441223487
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:aOgQsLqPQLHbXTN6oYsNhd6vgAwFQCbTprO5BPPTeraG9n0WP/zgSRQh:aOgQO3hdE8KBPPTrGHU5
                                                                                                                                                                                                                                            MD5:DC2829239704CDD5A5109699666FA573
                                                                                                                                                                                                                                            SHA1:60C09E102F552444D59ED9ED474E667136C16DC0
                                                                                                                                                                                                                                            SHA-256:AB4BE7D34E7FA0E722F0948E0C90AD4D95B8A1EC649C2F186DFA387B57BE7833
                                                                                                                                                                                                                                            SHA-512:F3551AEF2A0FFE42A16F1A8BE26B2C2722E773A59D21B60B2454AB0B68B008402623F378D2AFAA30FEBA87F560475A52D2899E6D062BD7F88E22119B25231F17
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*. * _mingw.h. *. * This file is for TinyCC and not part of the Mingw32 package.. *. * THIS SOFTWARE IS NOT COPYRIGHTED. *. * This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. *. * This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. *. */..#ifndef __MINGW_H.#define __MINGW_H../* some winapi files define these before including _mingw.h --> */.#undef __cdecl.#undef _X86_.#undef WIN32./* <-- */..#include <stddef.h>.#include <stdarg.h>..#define __int8 char.#define __int16 short.#define __int32 int.#define __int64 long long.#define _HAVE_INT64..#define __cdecl.#define __declspec(x) __attribute__((x)).#define __unaligned __attribute__((packed)).#define __fastcall __attribute__((fastcall))..#define __MSVCRT__ 1.#undef _MSVCRT_

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\assert.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1439
                                                                                                                                                                                                                                            Entropy (8bit):5.2295620824781714
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDaGduHH7PPW3ep0m3Vp0GrHt+5p0CKpmucLNw/HHsuHfgpbrRD:GRdm3emm3Vm+HOmCKmC1fgdp
                                                                                                                                                                                                                                            MD5:9C022D741996DB6D32411BFEF4EADB41
                                                                                                                                                                                                                                            SHA1:4BA93D77927EB8CFDCFE07F56D6EDADE180AF1DD
                                                                                                                                                                                                                                            SHA-256:3AB7EDEC5E55840C35BE252BAD52236955C3B4F9143810CDB1F09C34510EB8C4
                                                                                                                                                                                                                                            SHA-512:E448608BFECB770A087CB19934A1B45A5C564EA10BDF5A40BBB250F472830ECEE4990C669E90E495ECB5D4E48C3871CC2A33CE84F2D38524449FC9F5FD501DA0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef __ASSERT_H_.#define __ASSERT_H_..#include <_mingw.h>.#ifdef __cplusplus.#include <stdlib.h>.#endif..#ifdef NDEBUG.#ifndef assert.#define assert(_Expression) ((void)0).#endif.#else..#ifndef _CRT_TERMINATE_DEFINED.#define _CRT_TERMINATE_DEFINED. void __cdecl __MINGW_NOTHROW exit(int _Code) __MINGW_ATTRIB_NORETURN;. _CRTIMP void __cdecl __MINGW_NOTHROW _exit(int _Code) __MINGW_ATTRIB_NORETURN;.#if !defined __NO_ISOCEXT /* extern stub in static libmingwex.a */./* C99 function name */.void __cdecl _Exit(int) __MINGW_ATTRIB_NORETURN;.__CRT_INLINE __MINGW_ATTRIB_NORETURN void __cdecl _Exit(int status).{ _exit(status); }.#endif..#pragma push_macro("abort").#undef abort. void __cdecl __declspec(noreturn) abort(void);.#pragma pop_macro("abort")..#endif..#ifdef __cplusplus.ext

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\celib.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):164
                                                                                                                                                                                                                                            Entropy (8bit):4.396200340591225
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:YRTvF08wB32DsxQGG+TSERKR9BeCTSERKRIHTSERKR7LsyodP1XGZovVOMD:oF08iGDsx9TSEIToCTSEIcTSEIVun4yJ
                                                                                                                                                                                                                                            MD5:623F15DB2D9075E9DE1E1E5217854933
                                                                                                                                                                                                                                            SHA1:247EBCAA4F74507EDC5E06E2382378561E67027E
                                                                                                                                                                                                                                            SHA-256:2C63CD52CD589A204C8E5F75B9179FD520BE1A0770A698303526BE4069613E3B
                                                                                                                                                                                                                                            SHA-512:34555DF799E9F54EFDFF3BE4498CF20565935A0D5A116D030475042E3BD1CEA9F949A8CC4D9DD5C320FD528879B6221CA70CA0B9068C1AC6381B55C4756D92C4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef celib_h..#define celib_h....typedef struct _cecs..{.. volatile int locked;.. volatile int threadif;.. volatile int lockcount; ..} cecs, *Pcecs;....#endif

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\conio.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11130
                                                                                                                                                                                                                                            Entropy (8bit):4.886603456377803
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:R9IFnJJzpoJItwJ+Y31t1d1uF8sFX9B17lHLQWq4QcHyQA3sG1:XI4IJ2WzPw
                                                                                                                                                                                                                                            MD5:6A61E54AD2614BA528414C7B69147CAF
                                                                                                                                                                                                                                            SHA1:242479133484E15A2AF816D95DDB053835BF4C64
                                                                                                                                                                                                                                            SHA-256:DE7161F85835D98B38FE6A19EF8973DCAF58EC237B1C91CF05AC535B2FF3845F
                                                                                                                                                                                                                                            SHA-512:468702A606E20FFA893054F676C56DFE6EB3D28A002BAE143298422AB388A2F2F78E318714F5274BC9EBD243863F5228D5EBEAD5F31D892E96D8742C8E6846A1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_CONIO.#define _INC_CONIO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP char *_cgets(char *_Buffer);. _CRTIMP int __cdecl _cprintf(const char *_Format,...);. _CRTIMP int __cdecl _cputs(const char *_Str);. _CRTIMP int __cdecl _cscanf(const char *_Format,...);. _CRTIMP int __cdecl _cscanf_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _getch(void);. _CRTIMP int __cdecl _getche(void);. _CRTIMP int __cdecl _vcprintf(const char *_Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_p(const char *_Format,...);. _CRTIMP int __cdecl _vcprintf_p(const char *_Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_l(const char *_Format,_loc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\ctype.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9755
                                                                                                                                                                                                                                            Entropy (8bit):5.0535405224800884
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:aK0sBzLLoy8q3JHZDrs+UAt0g7WnBeaIlzjD:EALLb8ars+Flzf
                                                                                                                                                                                                                                            MD5:22E5A00491E32D15B40B196397AD01C1
                                                                                                                                                                                                                                            SHA1:B0DB6FCBF4ABD2F4FDEA2771399C1E502D9F8106
                                                                                                                                                                                                                                            SHA-256:4CFAAA43B3F7414984126E8B1CDF65F9DAC0EF68D9A3396BE0B8828376A74A6B
                                                                                                                                                                                                                                            SHA-512:28839104776441738233334A20DE6CE3ADA51179FB50366C27AB60432949FC78E1CCF735D2E80216F8779D84328634005C322D0010875E8FE0FF33D699ECC114
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_CTYPE.#define _INC_CTYPE..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func().(_pctype).#else.#define __pctype_func().(*_imp___pctype).#endif.#endif..#ifndef _pctype.#ifdef _MSVCRT_. extern unsigned short *_pctype;.#else. extern unsigned short **_imp___pctype;.#define _pctype (*_imp___pctype).#endif.#endif..#endif.#endif..#ifndef _CRT_WCTYPEDATA_DEFINED.#define _CRT_WCTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS.#ifndef _wctype.#ifdef _MSVCRT_. extern unsigned short *_wctype;.#else. extern unsigned short **_im

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\dir.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):952
                                                                                                                                                                                                                                            Entropy (8bit):4.981227039868006
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDadJeDoxsClLEdPQq15Fo30wLwNOk60:GYo6XDQsLp
                                                                                                                                                                                                                                            MD5:EF5C7267DF270272BFA8F8EBD1B516F2
                                                                                                                                                                                                                                            SHA1:1E3F8A9AFD814EFA8CF7C88DC480E9914A5BC570
                                                                                                                                                                                                                                            SHA-256:84064B17E501D691C43D47E45B112C2884DB467417910B5FA1482B72342BADFB
                                                                                                                                                                                                                                            SHA-512:8CA2B0E08B66EAA843FC7AD0F8F4063450A469914819A637AA3F8CAC39DD38E32CC0403F2B04F767AE486934026585B56F93544C8A1F5D92CCE32CE84A4506F4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* . * dir.h. *. * This file OBSOLESCENT and only provided for backward compatibility.. * Please use io.h instead.. *. * This file is part of the Mingw32 package.. *. * Contributors:. * Created by Colin Peters <colin@bird.fu.is.saga-u.ac.jp>. * Mumit Khan <khan@xraylith.wisc.edu>. *. * THIS SOFTWARE IS NOT COPYRIGHTED. *. * This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. *. * This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. *. */..#include <io.h>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\direct.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1979
                                                                                                                                                                                                                                            Entropy (8bit):5.047752773488744
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDnZTwNe2FhqA7DiyX40E090m0c0/0vF7Gl0lF+yivXw0vZ0CZ0F2xFeHv:Gs6Z7aNA7bmwGOK0gZBZCQs
                                                                                                                                                                                                                                            MD5:83679DA78AAF8F8352ACB1883B9EF868
                                                                                                                                                                                                                                            SHA1:FD89079636571A93755120120AB4F03B91076478
                                                                                                                                                                                                                                            SHA-256:179C3204312D7CF8032102773629BCB3E5FFF792D1D808931CB6619A431D2435
                                                                                                                                                                                                                                            SHA-512:13AF1F2C118E898E6055CA61286C9766DF75366FF4F30708F613193CD8F89AFC4A4CC2FD31FC3AC6DCE5D577EE83E203F79ACA3B739D9D9E9E60B42CD9C7036E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_DIRECT.#define _INC_DIRECT..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif.. _CRTIMP char *__cdecl _getcwd(char *_DstBuf,int _SizeInBytes);. _CRTIMP char *__cdecl _getdcwd(int _Drive,char *_DstBuf,int _SizeInBytes);. char *__cdecl _getdcwd_nolock(int _Drive,char *_DstBuf,int _SizeInBytes);. _CRTIMP int __cdecl _chdir(const char *_Path);. _CRTIMP int __cdecl _mkdir(const char *_Path);. _CRTIMP int __cdecl _rmdir(const char *_Path);. _CRTIMP int __cdecl _chdrive(int _Drive);. _CRTIMP in

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\dirent.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3339
                                                                                                                                                                                                                                            Entropy (8bit):4.737300914010111
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GzyKQvcpqt7K7PnON+J3esAYUJ0q/nfB2Vt7K7qpdSVNsJ35sAYqJ0q/WaLcC:ayfv0ONgcKqvspkVNyh8q+UcC
                                                                                                                                                                                                                                            MD5:AFBE32EE6DED8CBAD33D6FE3FBBF077D
                                                                                                                                                                                                                                            SHA1:A7F0D3EDEE5F49E127575EB25E64E2747108E7C3
                                                                                                                                                                                                                                            SHA-256:88C1F767FDCD6D51B991EE3234792DA48C8576F5F8816F17A42344F9C8BBB1C1
                                                                                                                                                                                                                                            SHA-512:F655A40F8C87A0CB43A34AE47612D5CEF2CF7814FD2AE9CE1C8566F97F45E91470364BD87E8C12861CCE44FB8CCA54717546BAACC6CCBDACE51D0D15206304DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* All the headers include this file. */.#include <_mingw.h>..#ifndef.__STRICT_ANSI__..#ifndef _DIRENT_H_.#define _DIRENT_H_...#pragma pack(push,_CRT_PACKING)..#include <io.h>..#ifndef RC_INVOKED..#ifdef __cplusplus.extern "C" {.#endif.. struct dirent. {. long..d_ino;../* Always zero. */. unsigned short.d_reclen;./* Always zero. */. unsigned short.d_namlen;./* Length of name in d_name. */. char*..d_name;../* File name. */. /* NOTE: The name in the dirent structure points to the name in the. * finddata_t structure in the DIR. */. };.. /*. * This is an internal data structure. Good programmers will not use it. * except as an argument to one of the functions below.. * dd_stat field is now int (was short in older versions).. */. typedef struct. {.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\dos.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1090
                                                                                                                                                                                                                                            Entropy (8bit):5.185707945606799
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDLDhTwNeehqAaZzTcvYRkvF76bUge/xXmy:GyDCHcOV6bULZv
                                                                                                                                                                                                                                            MD5:3B6FBC94238DF0FD001B04D55BC899DB
                                                                                                                                                                                                                                            SHA1:231E18CE6A5488B2353FB9EF052FD6677C2CF555
                                                                                                                                                                                                                                            SHA-256:3AFEA4AE85C68987FE59F40592AC5EA3EF1049B4FB72612BB185358D628E2DEC
                                                                                                                                                                                                                                            SHA-512:28BA3ED6CC9511F17798822FA81A2D16DA17CA4AF9DA64F3EDC9170FBB883801BF07390214C54B58A32251E6A1C3BB359CB76E892DDB77FBF8C1BF3985E13E5E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_DOS.#define _INC_DOS..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED.. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif..#define _A_NORMAL 0x00.#define _A_RDONLY 0x01.#define _A_HIDDEN 0x02.#define _A_SYSTEM 0x04.#define _A_SUBDIR 0x10.#define _A_ARCH 0x20..#ifndef _GETDISKFREE_DEFINED.#define _GETDISKFREE_DEFINED. _CRTIMP unsigned __cdecl _getdiskfree(unsigned _Drive,struct _diskfree_t *_DiskFree);.#endif..#if (defined(_X86_) && !defined(__x86_64)). void __cdecl _disable(void);. void __cdecl _enable(void);.#endif..#ifndef.NO_OLDNAMES.#de

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\errno.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1410
                                                                                                                                                                                                                                            Entropy (8bit):5.11838654592129
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDZ8CF1niJLkkutU0IdH6lO7baol3fRfUJhBJXs:Gi4YeH8915s
                                                                                                                                                                                                                                            MD5:B81E5A965ABD076FB52DE6DFA22A78C4
                                                                                                                                                                                                                                            SHA1:DC11ACF6A38871E60D79108DAD6C3156715F05E7
                                                                                                                                                                                                                                            SHA-256:7C8494FE57D944773861C4C1CC1F2B46B3111144A24BF505B3D47B32F0AC1E8A
                                                                                                                                                                                                                                            SHA-512:8F3057882753150FEFA734897ECFD8DC4082580E856947910FCD891D744651706338A7DF78C1DCF1C7E54EE79EA2A6E8D2646BE9DAC92EF301D7347801F04273
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_ERRNO.#define _INC_ERRNO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRT_ERRNO_DEFINED.#define _CRT_ERRNO_DEFINED. _CRTIMP extern int *__cdecl _errno(void);.#define errno (*_errno()).. errno_t __cdecl _set_errno(int _Value);. errno_t __cdecl _get_errno(int *_Value);.#endif..#define EPERM 1.#define ENOENT 2.#define ESRCH 3.#define EINTR 4.#define EIO 5.#define ENXIO 6.#define E2BIG 7.#define ENOEXEC 8.#define EBADF 9.#define ECHILD 10.#define EAGAIN 11.#define ENOMEM 12.#define EACCES 13.#define EFAULT 14.#define EBUSY 16.#define EEXIST 17.#define EXDEV 18.#define ENODEV 19.#define ENOTDIR 20.#define EISDIR 21.#define ENFILE 23.#define EMFILE 24.#define ENOTTY 25.#define EFBIG 27.#define ENOSPC 28.#define ESPIPE 29.#define EROFS 30.#de

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\excpt.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3796
                                                                                                                                                                                                                                            Entropy (8bit):5.3190944253059405
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GdUcbUGSCnlAxeSeFkvSp2wCoIt6TcUEYEJ+CkbUHfXF0XQtVI:QTIGTWeFk6pw/6TOMvIfFsA+
                                                                                                                                                                                                                                            MD5:D236372CBA09E14C37B4E48F81BAEF83
                                                                                                                                                                                                                                            SHA1:11A3BFFAACEDFA1CAA4B4BB836CD95297A4ECC6D
                                                                                                                                                                                                                                            SHA-256:0098E51602C94F8A9702F4B776D3630F56EEC27ED67B9FC36D9204933B58AC4D
                                                                                                                                                                                                                                            SHA-512:D7C22525FBB97BF8950DB69645511420F1198ABE33F5D0FE07A5EE8DD6B5CDA07038B6DB71A2995C6F5EC1B85D8B98E4370330193132E95F2A65E3A847F04408
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_EXCPT.#define _INC_EXCPT..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif.. struct _EXCEPTION_POINTERS;..#ifndef EXCEPTION_DISPOSITION.#define EXCEPTION_DISPOSITION int.#endif.#define ExceptionContinueExecution 0.#define ExceptionContinueSearch 1.#define ExceptionNestedException 2.#define ExceptionCollidedUnwind 3..#if (defined(_X86_) && !defined(__x86_64)). struct _EXCEPTION_RECORD;. struct _CONTEXT;.. EXCEPTION_DISPOSITION __cdecl _except_handler(struct _EXCEPTION_RECORD *_ExceptionRecord,void *_EstablisherFrame,struct _CONTEXT *_ContextRecord,void *_DispatcherContext);.#elif defined(__ia64__).. typedef struct _EXCEPTION_POINTERS *Exception_info_ptr;. struct _EXCEPTION_RECORD;. struct _CONTEXT;. struct _DISP

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\fcntl.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1269
                                                                                                                                                                                                                                            Entropy (8bit):5.067511244355359
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDeLwFq64bCszOD1zr/Aob1UBFv1tDaMLQHy2RoP/17FN:GOFq6UkybLGMLgyx/17z
                                                                                                                                                                                                                                            MD5:478ADD63D2C741D03A60A11BDC4FC0D3
                                                                                                                                                                                                                                            SHA1:E9E0C857D2C409F23C346D81B77C5634F1C395AB
                                                                                                                                                                                                                                            SHA-256:FBD94F945A57165AC897BDBACD2A861B1351E7850FA76752703C0A622E0646FA
                                                                                                                                                                                                                                            SHA-512:BCCC563718B1A03E93E5BF8CF0D79BB3128A3FC1FDD6FBC17792CBAF3C5DE70DE06EC2F88D8EED7105FF62056E32E9A79570F5890E75F4443033421D283B2FEC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#include <io.h>..#ifndef _INC_FCNTL.#define _INC_FCNTL..#define _O_RDONLY 0x0000.#define _O_WRONLY 0x0001.#define _O_RDWR 0x0002.#define _O_APPEND 0x0008.#define _O_CREAT 0x0100.#define _O_TRUNC 0x0200.#define _O_EXCL 0x0400.#define _O_TEXT 0x4000.#define _O_BINARY 0x8000.#define _O_WTEXT 0x10000.#define _O_U16TEXT 0x20000.#define _O_U8TEXT 0x40000.#define _O_ACCMODE (_O_RDONLY|_O_WRONLY|_O_RDWR)..#define _O_RAW _O_BINARY.#define _O_NOINHERIT 0x0080.#define _O_TEMPORARY 0x0040.#define _O_SHORT_LIVED 0x1000..#define _O_SEQUENTIAL 0x0020.#define _O_RANDOM 0x0010..#if !defined(NO_OLDNAMES) || defined(_POSIX).#define O_RDONLY _O_RDONLY.#define O_WRONLY _O_WRONLY.#define O_RDWR _O_RDWR.#define O_APPEND _O_APPEND.#define O_CREAT _O_CREAT.#define O_TRUNC _O_TRUNC

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\fenv.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3146
                                                                                                                                                                                                                                            Entropy (8bit):5.109358717547865
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GjF4XfZlIPU0rBLeGwDO0QZFxI2bMCaZSpEhW8bxv:CivoPU0rBLeRDO0QfxI2YCaZZhNl
                                                                                                                                                                                                                                            MD5:DEEC7C35F77EC8E22074667641CA8851
                                                                                                                                                                                                                                            SHA1:8CCE6B663A9A04B3C13AA6621B0798E487A8A88E
                                                                                                                                                                                                                                            SHA-256:67A827ACF4E09653AFB5D18F2ECAA5FCDFB7471D8A5B8197C2F33D06E8462F84
                                                                                                                                                                                                                                            SHA-512:8DE2B82B0579E6C37546A26BC1AB5D7603090E815D8CE728474B1405339AB4EF4F0794DF19FF4CC3780AA7259288D4D93FD50B0E9C63D413FF22AD5E72BFCBE5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _FENV_H_.#define _FENV_H_..#include <_mingw.h>../* FPU status word exception flags */.#define FE_INVALID.0x01.#define FE_DENORMAL.0x02.#define FE_DIVBYZERO.0x04.#define FE_OVERFLOW.0x08.#define FE_UNDERFLOW.0x10.#define FE_INEXACT.0x20.#define FE_ALL_EXCEPT (FE_INVALID | FE_DENORMAL | FE_DIVBYZERO \... | FE_OVERFLOW | FE_UNDERFLOW | FE_INEXACT)../* FPU control word rounding flags */.#define FE_TONEAREST.0x0000.#define FE_DOWNWARD.0x0400.#define FE_UPWARD.0x0800.#define FE_TOWARDZERO.0x0c00../* The MXCSR exception flags are the same as the. FE flags. */.#define __MXCSR_EXCEPT_FLAG_SHIFT 0../* How much to shift FE status word exception flags. to get MXCSR rounding flags, */.#define __MXCSR_ROUND_FLAG_SHIFT 3..#ifndef RC_INVOKED./*. For now, support only for t

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\float.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1374
                                                                                                                                                                                                                                            Entropy (8bit):5.161015521868813
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:9Mz83vjoKY2mg/oCrPy+lUmCSh/PTtcmBSED9smlS1:9MEj+bkoCrqahXBPSEDWJ
                                                                                                                                                                                                                                            MD5:3B2E4B0C01E5B0B790F4F6751E977CC9
                                                                                                                                                                                                                                            SHA1:06DB05E1C73809CD442EF58F775A8E87D708421D
                                                                                                                                                                                                                                            SHA-256:C9BAAA478E3BA85897B781F7065B9E144FAACC8E81CAFA5A642B5D49C78434EB
                                                                                                                                                                                                                                            SHA-512:28DD57DC4360292B987D38A408771B5E1D5B423BFD9656BEE9DFA2F9BC19696AF63A7F90CD350C8445BB27C5049987D97D9530AB15F3697D37652A91AAA7F892
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _FLOAT_H_.#define _FLOAT_H_..#define FLT_RADIX 2../* IEEE float */.#define FLT_MANT_DIG 24.#define FLT_DIG 6.#define FLT_ROUNDS 1.#define FLT_EPSILON 1.19209290e-07F.#define FLT_MIN_EXP (-125).#define FLT_MIN 1.17549435e-38F.#define FLT_MIN_10_EXP (-37).#define FLT_MAX_EXP 128.#define FLT_MAX 3.40282347e+38F.#define FLT_MAX_10_EXP 38../* IEEE double */.#define DBL_MANT_DIG 53.#define DBL_DIG 15.#define DBL_EPSILON 2.2204460492503131e-16.#define DBL_MIN_EXP (-1021).#define DBL_MIN 2.2250738585072014e-308.#define DBL_MIN_10_EXP (-307).#define DBL_MAX_EXP 1024.#define DBL_MAX 1.7976931348623157e+308.#define DBL_MAX_10_EXP 308../* horrible intel long double */.#if defined __i386__ || defined __x86_64__..#define LDBL_MANT_DIG 64.#define LDBL_DIG 18.#define LDBL_EPSILON 1.08420217248550443401e-19L.#define LDBL_MIN_EXP (-16381).#define LDBL_MIN 3.36210314311209350626e-4932L.#define LDBL_MIN_10_EXP (-4931).#define LDBL_MAX_EXP 16384.#define LDBL_MAX 1.18973149535723176502e+4932L.#defin

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\inttypes.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6072
                                                                                                                                                                                                                                            Entropy (8bit):5.148919168403688
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:a0GgtlRUn9ZpD5AgcpqdvDp/pwZzSAGkKTskBkbBpbwlHrhchgM2bRBhuYBbV3VU:a0GgJUn9ZpD+gcpqdvDp/pwZzP1iskSX
                                                                                                                                                                                                                                            MD5:6BB72461C8C72CC3B96F78C73FA803BA
                                                                                                                                                                                                                                            SHA1:4506FB8BFA1622D4533DB176B3DCFAB0AE021672
                                                                                                                                                                                                                                            SHA-256:4194C0408CDBA330B7CFA1D2091D72A0CFBF2077FF1FEB19F436F3F3AA2ADF18
                                                                                                                                                                                                                                            SHA-512:5F6D95651183FBCE7490A619D37672F2D3BAC516319D0EDCD4E782A77632B457632EB83AB54B67132752649FBBFBD1D4EB2B4ABA2622BDF729F0C4BD7509DB2B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* 7.8 Format conversion of integer types <inttypes.h> */..#ifndef _INTTYPES_H_.#define _INTTYPES_H_..#include <_mingw.h>.#include <stdint.h>.#define __need_wchar_t.#include <stddef.h>..#ifdef.__cplusplus.extern."C".{.#endif..typedef struct {..intmax_t quot;..intmax_t rem;..} imaxdiv_t;..#if !defined(__cplusplus) || defined(__STDC_FORMAT_MACROS)../* 7.8.1 Macros for format specifiers. * . * MS runtime does not yet understand C9x standard "ll". * length specifier. It appears to treat "ll" as "l".. * The non-standard I64 length specifier causes warning in GCC,. * but understood by MS runtime functions.. */../* fprintf macros for signed types */.#define PRId8 "d".#define PRId16 "d".#define PRId32 "d".#define PRId64 "I64d"..#define PRIdLEAST8 "d".#define PRIdLEAST16 "d".#define PR

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\io.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13067
                                                                                                                                                                                                                                            Entropy (8bit):5.032337228232408
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Y8Bx8BjP8BJPKf37Rw8z/hI9B3mpv6O3O8iONUO5OG0xLIJ8SNgVSAMczPO8cONU:r02oxz7vX+8fNxIG0S8SNgVxz28ZNU
                                                                                                                                                                                                                                            MD5:4AC0744EF16453FEBED8DE4242997946
                                                                                                                                                                                                                                            SHA1:B092C9006DE0A8DBE7F0FF568B6CAAFB00B4C90A
                                                                                                                                                                                                                                            SHA-256:5DA97C850E8E2AB608C42947A33411F556F6D75B8264E1E5CF29CA7BA7B96256
                                                                                                                                                                                                                                            SHA-512:1EC9947C6FE0160954F3922D6990863865D274874C31355F0838CCBB1BBF6650A9A3F0D3590537A189AFBF80E33CDE5393260FDD5F3EA5A736A066CDCC5FF815
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:./**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _IO_H_.#define _IO_H_..#include <_mingw.h>.#include <string.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _POSIX_..#ifdef __cplusplus.extern "C" {.#endif.._CRTIMP char* __cdecl _getcwd (char*, int);.#ifndef _FSIZE_T_DEFINED. typedef unsigned long _fsize_t;.#define _FSIZE_T_DEFINED.#endif..#ifndef _FINDDATA_T_DEFINED.. struct _finddata32_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. _fsize_t size;. char name[260];. };../*#if _INTEGRAL_MAX_BITS >= 64*/.. struct _finddata32i64_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. __int64 size;. char name[260];. };.. struct _finddata64i32_t {. unsigned attrib;. __time64_t time_create

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-04N8G.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):31364
                                                                                                                                                                                                                                            Entropy (8bit):4.752286291497649
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:ngntwzzdfQQbqvoRFCM/CVwLn4wyQoPUQ:PzdfQQbqvo1UwNoPUQ
                                                                                                                                                                                                                                            MD5:E237270733EDC1CB97B10870A3D50A69
                                                                                                                                                                                                                                            SHA1:C2406D465B5E8D94E1CB61C6C3F312BDB018AC80
                                                                                                                                                                                                                                            SHA-256:7FE5FDE028FF8F69D2BDA910664E2C169E7B92C6E7F2CF7915EB72054A9746FF
                                                                                                                                                                                                                                            SHA-512:8DF9ADD42AD3C8C378E93AF4BEC69489D59B8088974A40EC04FB91749DC050E3000674C9388FAE9937F87D6ABB60199B13D179BF0A8654370A66DB64CDD2E1B1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#ifndef _INC_TCHAR.#define _INC_TCHAR..#ifdef _STRSAFE_H_INCLUDED_.#error Need to include strsafe.h after tchar.h.#endif..#ifdef __cplusplus.extern "C" {.#endif..#define _ftcscat _tcscat.#define _ftcschr _tcschr.#define _ftcscpy _tcscpy.#define _ftcscspn _tcscspn.#define _ftcslen _tcslen.#define _ftcsncat _tcsncat.#define _ftcsncpy _tcsncpy.#define _ftcspbrk _tcspbrk.#define _ftcsrchr _tcsrchr.#define _ftcsspn _tcsspn.#define _ftcsstr _tcsstr.#define _ftcstok _tcstok..#define _ftcsdup _tcsdup.#define _ftcsnset _tcsnset.#define _ftcsrev _tcsrev.#define _ftcsset _tcsset..#define _ftcscmp _tcscmp.#define _ftcsicmp _tcsicmp.#define _ftcsnccmp _tcsnccmp.#define _ftcsncmp _tcsncmp.#define _ftcsncicmp _tcsncicmp.#define _ftcsnicmp _tcsnicmp..#define _ftcscoll _tc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-2KOGR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13067
                                                                                                                                                                                                                                            Entropy (8bit):5.032337228232408
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Y8Bx8BjP8BJPKf37Rw8z/hI9B3mpv6O3O8iONUO5OG0xLIJ8SNgVSAMczPO8cONU:r02oxz7vX+8fNxIG0S8SNgVxz28ZNU
                                                                                                                                                                                                                                            MD5:4AC0744EF16453FEBED8DE4242997946
                                                                                                                                                                                                                                            SHA1:B092C9006DE0A8DBE7F0FF568B6CAAFB00B4C90A
                                                                                                                                                                                                                                            SHA-256:5DA97C850E8E2AB608C42947A33411F556F6D75B8264E1E5CF29CA7BA7B96256
                                                                                                                                                                                                                                            SHA-512:1EC9947C6FE0160954F3922D6990863865D274874C31355F0838CCBB1BBF6650A9A3F0D3590537A189AFBF80E33CDE5393260FDD5F3EA5A736A066CDCC5FF815
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:./**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _IO_H_.#define _IO_H_..#include <_mingw.h>.#include <string.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _POSIX_..#ifdef __cplusplus.extern "C" {.#endif.._CRTIMP char* __cdecl _getcwd (char*, int);.#ifndef _FSIZE_T_DEFINED. typedef unsigned long _fsize_t;.#define _FSIZE_T_DEFINED.#endif..#ifndef _FINDDATA_T_DEFINED.. struct _finddata32_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. _fsize_t size;. char name[260];. };../*#if _INTEGRAL_MAX_BITS >= 64*/.. struct _finddata32i64_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. __int64 size;. char name[260];. };.. struct _finddata64i32_t {. unsigned attrib;. __time64_t time_create

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-3C6IU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):126
                                                                                                                                                                                                                                            Entropy (8bit):4.580595223579644
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:UwqZKUaAJAtMLnKEwOEtLDLaF9rL4AsNXIC:Uwq1LJvnKEcXaF94FNXIC
                                                                                                                                                                                                                                            MD5:621045AE9CA57FE30C8A99DD52AC5703
                                                                                                                                                                                                                                            SHA1:39B1E30A678EAC4DF1B78C0EF9D315A18DF4F156
                                                                                                                                                                                                                                            SHA-256:FA3758847B33F59ABE99B023BE00D8A027C391ECD0580A1FE755497C11E0C723
                                                                                                                                                                                                                                            SHA-512:AADE260048487D82F129A9A51FBDEA949793465C33DC147B31943D22523FB1A63C48F80FCA370D5929BCCA76B89CD15D9786C439A65C396BB4A5416D387E3F3A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*. * TODO: Nothing here yet. Should provide UNIX compatibility constants. * comparable to those in limits.h and float.h.. */.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-44CC1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1979
                                                                                                                                                                                                                                            Entropy (8bit):5.047752773488744
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDnZTwNe2FhqA7DiyX40E090m0c0/0vF7Gl0lF+yivXw0vZ0CZ0F2xFeHv:Gs6Z7aNA7bmwGOK0gZBZCQs
                                                                                                                                                                                                                                            MD5:83679DA78AAF8F8352ACB1883B9EF868
                                                                                                                                                                                                                                            SHA1:FD89079636571A93755120120AB4F03B91076478
                                                                                                                                                                                                                                            SHA-256:179C3204312D7CF8032102773629BCB3E5FFF792D1D808931CB6619A431D2435
                                                                                                                                                                                                                                            SHA-512:13AF1F2C118E898E6055CA61286C9766DF75366FF4F30708F613193CD8F89AFC4A4CC2FD31FC3AC6DCE5D577EE83E203F79ACA3B739D9D9E9E60B42CD9C7036E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_DIRECT.#define _INC_DIRECT..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif.. _CRTIMP char *__cdecl _getcwd(char *_DstBuf,int _SizeInBytes);. _CRTIMP char *__cdecl _getdcwd(int _Drive,char *_DstBuf,int _SizeInBytes);. char *__cdecl _getdcwd_nolock(int _Drive,char *_DstBuf,int _SizeInBytes);. _CRTIMP int __cdecl _chdir(const char *_Path);. _CRTIMP int __cdecl _mkdir(const char *_Path);. _CRTIMP int __cdecl _rmdir(const char *_Path);. _CRTIMP int __cdecl _chdrive(int _Drive);. _CRTIMP in

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-4Q1BH.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):23077
                                                                                                                                                                                                                                            Entropy (8bit):5.0910424086795425
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:lpwI012C9/SKSP4qROW8JuWucZBFRzWhHONMLPik9OeY:lpq2C9/FA4OOJr
                                                                                                                                                                                                                                            MD5:631F16C4A65CF2F47FA49C9220D9C500
                                                                                                                                                                                                                                            SHA1:330EADF08FDCB31747BF7C84182F2A5EECFA3FAB
                                                                                                                                                                                                                                            SHA-256:0BC33882BD2AF1E7D33C38C0160E2A0AE737836815360765750CDC7E98E5DFC5
                                                                                                                                                                                                                                            SHA-512:92EB690CA7D563269CEAEFFAC1F0FFBA6D010568431843F2DD82DCA7A1ACA0E6634C3335202ED5559FE631B0ED7C585DC1C3F5BB248FE3D571BA754B22B6AD5A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _MATH_H_.#define _MATH_H_..#if __GNUC__ >= 3.#pragma GCC system_header.#endif..#include <_mingw.h>..struct exception;..#pragma pack(push,_CRT_PACKING)..#define _DOMAIN 1.#define _SING 2.#define _OVERFLOW 3.#define _UNDERFLOW 4.#define _TLOSS 5.#define _PLOSS 6..#ifndef __STRICT_ANSI__.#ifndef.NO_OLDNAMES.#define DOMAIN _DOMAIN.#define SING _SING.#define OVERFLOW _OVERFLOW.#define UNDERFLOW _UNDERFLOW.#define TLOSS _TLOSS.#define PLOSS _PLOSS.#endif.#endif..#ifndef __STRICT_ANSI__.#define M_E 2.71828182845904523536.#define M_LOG2E 1.44269504088896340736.#define M_LOG10E 0.434294481903251827651.#define M_LN2 0.693147180559945309417.#define M_LN10 2.30258509299404568402.#define M_PI 3.14159265358979323846.#define M_PI_2 1.57079632679489661923.#define M_PI_4 0.785398163397

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-6J8NC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):639
                                                                                                                                                                                                                                            Entropy (8bit):5.116570644892466
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BWIYKIiSUfwfvarry9rowrrqir3qGr+PFeHqveB7n4y8yvkA4p:i2PSh0PDWWIivavaq98whzlgFeHqve7u
                                                                                                                                                                                                                                            MD5:540EF403878DDBE2D4682540DA20095F
                                                                                                                                                                                                                                            SHA1:4E3230DF4B7A906CDC3B6E3E1A5CC768CC79C327
                                                                                                                                                                                                                                            SHA-256:6DE922C1BD7EEDC33308304785C212945064D763EEDFB373C09CBBB5CB933DDE
                                                                                                                                                                                                                                            SHA-512:7C27842CB6F3D2B9707A5DF55B45BCC5DD613CDA8C550F0232F0CB9DF8B59013F428EC3FC07FB002DFF80D26BB9941CE76CAADD22BD4B539C9F11EA13FE12EF5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SHARE.#define _INC_SHARE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#define _SH_COMPAT 0x00.#define _SH_DENYRW 0x10.#define _SH_DENYWR 0x20.#define _SH_DENYRD 0x30.#define _SH_DENYNO 0x40.#define _SH_SECURE 0x80..#ifndef.NO_OLDNAMES.#define SH_COMPAT _SH_COMPAT.#define SH_DENYRW _SH_DENYRW.#define SH_DENYWR _SH_DENYWR.#define SH_DENYRD _SH_DENYRD.#define SH_DENYNO _SH_DENYNO.#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-70FRS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6072
                                                                                                                                                                                                                                            Entropy (8bit):5.148919168403688
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:a0GgtlRUn9ZpD5AgcpqdvDp/pwZzSAGkKTskBkbBpbwlHrhchgM2bRBhuYBbV3VU:a0GgJUn9ZpD+gcpqdvDp/pwZzP1iskSX
                                                                                                                                                                                                                                            MD5:6BB72461C8C72CC3B96F78C73FA803BA
                                                                                                                                                                                                                                            SHA1:4506FB8BFA1622D4533DB176B3DCFAB0AE021672
                                                                                                                                                                                                                                            SHA-256:4194C0408CDBA330B7CFA1D2091D72A0CFBF2077FF1FEB19F436F3F3AA2ADF18
                                                                                                                                                                                                                                            SHA-512:5F6D95651183FBCE7490A619D37672F2D3BAC516319D0EDCD4E782A77632B457632EB83AB54B67132752649FBBFBD1D4EB2B4ABA2622BDF729F0C4BD7509DB2B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* 7.8 Format conversion of integer types <inttypes.h> */..#ifndef _INTTYPES_H_.#define _INTTYPES_H_..#include <_mingw.h>.#include <stdint.h>.#define __need_wchar_t.#include <stddef.h>..#ifdef.__cplusplus.extern."C".{.#endif..typedef struct {..intmax_t quot;..intmax_t rem;..} imaxdiv_t;..#if !defined(__cplusplus) || defined(__STDC_FORMAT_MACROS)../* 7.8.1 Macros for format specifiers. * . * MS runtime does not yet understand C9x standard "ll". * length specifier. It appears to treat "ll" as "l".. * The non-standard I64 length specifier causes warning in GCC,. * but understood by MS runtime functions.. */../* fprintf macros for signed types */.#define PRId8 "d".#define PRId16 "d".#define PRId32 "d".#define PRId64 "I64d"..#define PRIdLEAST8 "d".#define PRIdLEAST16 "d".#define PR

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-7NEAF.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2494
                                                                                                                                                                                                                                            Entropy (8bit):4.862990168468474
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:QAs3d3qmP8lV0TTPWuj/ATVhpIOFf6yrsEgTvVOFobil:QAGdafP0P/IiA
                                                                                                                                                                                                                                            MD5:4FE6BA37DEC896AB822646118B5343CE
                                                                                                                                                                                                                                            SHA1:EA68660748139159643AB495AA1EC9287A5E20FF
                                                                                                                                                                                                                                            SHA-256:116504A7C3FEABBC4551E9DB0BEC957170647EF2067EB46A4304BCBFDDCE5A30
                                                                                                                                                                                                                                            SHA-512:6B3304630293A2A5C1D4870B088A7FA2681354A4D28D6DFD97CDA16E102D6E97A19CB5C9A840C8587479E4A559AB3EE781F1E9001F1336C9318988B1F2F22CC7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _STDARG_H.#define _STDARG_H..#ifdef __x86_64__.#ifndef _WIN64..//This should be in sync with the declaration on our lib/libtcc1.c./* GCC compatible definition of va_list. */.typedef struct {. unsigned int gp_offset;. unsigned int fp_offset;. union {. unsigned int overflow_offset;. char *overflow_arg_area;. };. char *reg_save_area;.} __va_list_struct;..typedef __va_list_struct va_list[1];..void __va_start(__va_list_struct *ap, void *fp);.void *__va_arg(__va_list_struct *ap, int arg_type, int size, int align);..#define va_start(ap, last) __va_start(ap, __builtin_frame_address(0)).#define va_arg(ap, type) \. (*(type *)(__va_arg(ap, __builtin_va_arg_types(type), sizeof(type), __alignof__(type)))).#define va_copy(dest, src) (*(dest) = *(src)).#define va_end(ap)../* avoid conflicting definition for va_list on Macs. */.#define _VA_LIST_T..#else /* _WIN64 */.typedef char *va_list;.#define va_start(ap,last) _

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-9U0RQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1233
                                                                                                                                                                                                                                            Entropy (8bit):5.1075312514305296
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDYqsS6s1UzFf5wNaCmwN0PK0PQvYaH2l2X:GlS6s1k5wNaRwNt95H2U
                                                                                                                                                                                                                                            MD5:29F62B1ADD26DC1AED3FAAD03FAC030D
                                                                                                                                                                                                                                            SHA1:6F605B9A153A987F2939AE6500D6391FDC107332
                                                                                                                                                                                                                                            SHA-256:B4341E188913A819FA3BF101078A95CA077780219373F424C39AD86C94E04B6F
                                                                                                                                                                                                                                            SHA-512:3D98E9F039DDA694A660BA7D2F7906FCD60016DC6A8FED78CEB7B191618318A68D34169B9480BA5727730F6BD6357A13FD02E0CDCA5439A45E06D2F0D61DABE0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_MEMORY.#define _INC_MEMORY..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CONST_RETURN.#define _CONST_RETURN.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void *__cdecl _memccpy(void *_Dst,const void *_Src,int _Val,size_t _MaxCount);. _CONST_RETURN void *__cdecl memchr(const void *_Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void *_Buf1,const void *_Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void *_Buf1,const void *_Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void *_Buf1,const void *_Buf2,size_t _Size);. void *__cdecl memcpy(void *_Dst,const void *_Src,size_t _Size);. void *__cdecl memset(void *_Dst,int _Val,si

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-9VBQS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8405
                                                                                                                                                                                                                                            Entropy (8bit):5.100723832842219
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:0ih8Bf8Bx8B6qwyKg758H898Bc8BQGDL2XMR6fm4RFeU6sxhE2JFE:0G8Bf8Bx8Bxwyz58O8Bc8Bv208m4RFeD
                                                                                                                                                                                                                                            MD5:698EA0C0196BA07E9B949406DBB9FFD7
                                                                                                                                                                                                                                            SHA1:7296CFE82FAB54F08D44CE9CBAB92BEF7D96C96E
                                                                                                                                                                                                                                            SHA-256:453793A2D6C6FC772D1CDD60E701FB3D393D752937C1D6B2CA64D5F1CEC9FD36
                                                                                                                                                                                                                                            SHA-512:49984DDD4866060D8E310CA6A2BD53DEA87ABA70778202C5EFED126C35B244DF90C42D61477775F327B30597138A73FB2B2EE2E1050DC6732FAEB766E870C146
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIME_H_.#define _TIME_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED.#define _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.#if defined(__GNUC__) && defined(__STRICT_ANSI__). typedef int _time64_t __attribute__ ((mode (DI)));.#else. typedef __int64 __time64_t;.#endif.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typ

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-B5EH7.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6333
                                                                                                                                                                                                                                            Entropy (8bit):5.377774221268906
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Od4Q69/YQhMgPRVQzD+5VO7wRUNsNwxzMD2eT:Ou/f3Riz65VO7wRUNsNwxG
                                                                                                                                                                                                                                            MD5:90C1945AFA014FC0F8D17078C51502CA
                                                                                                                                                                                                                                            SHA1:F3A15DC3E32ED97B8CC34C1AFA2C66ECBA3B3BE4
                                                                                                                                                                                                                                            SHA-256:33C6C8DA7D564B5702AF8C6FF45C00A16842BA3FFE3F95F7F6232752F63C5AFD
                                                                                                                                                                                                                                            SHA-512:BE8557BDA158662ACC18CBD4445D4D2E6787FB5C78A67F0D0E4A62FFC9D2B1173C30C66CA5C6A247DA8FE7C38B7C57AFF050BD4A35B0120BD95400CFB4C2C2B6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* ISO C9x 7.18 Integer types <stdint.h>. * Based on ISO/IEC SC22/WG14 9899 Committee draft (SC22 N2794). *. * THIS SOFTWARE IS NOT COPYRIGHTED. *. * Contributor: Danny Smith <danny_r_smith_2001@yahoo.co.nz>. *. * This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. *. * This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. *. * Date: 2000-12-02. */...#ifndef _STDINT_H.#define _STDINT_H..#include <_mingw.h>..#define __need_wint_t.#define __need_wchar_t.#include "stddef.h"..#ifndef __int8_t_defined.#define __int8_t

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-B5TJI.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3339
                                                                                                                                                                                                                                            Entropy (8bit):4.737300914010111
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GzyKQvcpqt7K7PnON+J3esAYUJ0q/nfB2Vt7K7qpdSVNsJ35sAYqJ0q/WaLcC:ayfv0ONgcKqvspkVNyh8q+UcC
                                                                                                                                                                                                                                            MD5:AFBE32EE6DED8CBAD33D6FE3FBBF077D
                                                                                                                                                                                                                                            SHA1:A7F0D3EDEE5F49E127575EB25E64E2747108E7C3
                                                                                                                                                                                                                                            SHA-256:88C1F767FDCD6D51B991EE3234792DA48C8576F5F8816F17A42344F9C8BBB1C1
                                                                                                                                                                                                                                            SHA-512:F655A40F8C87A0CB43A34AE47612D5CEF2CF7814FD2AE9CE1C8566F97F45E91470364BD87E8C12861CCE44FB8CCA54717546BAACC6CCBDACE51D0D15206304DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* All the headers include this file. */.#include <_mingw.h>..#ifndef.__STRICT_ANSI__..#ifndef _DIRENT_H_.#define _DIRENT_H_...#pragma pack(push,_CRT_PACKING)..#include <io.h>..#ifndef RC_INVOKED..#ifdef __cplusplus.extern "C" {.#endif.. struct dirent. {. long..d_ino;../* Always zero. */. unsigned short.d_reclen;./* Always zero. */. unsigned short.d_namlen;./* Length of name in d_name. */. char*..d_name;../* File name. */. /* NOTE: The name in the dirent structure points to the name in the. * finddata_t structure in the DIR. */. };.. /*. * This is an internal data structure. Good programmers will not use it. * except as an argument to one of the functions below.. * dd_stat field is now int (was short in older versions).. */. typedef struct. {.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-BR3E9.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14903
                                                                                                                                                                                                                                            Entropy (8bit):5.137879509844942
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:VgGovkt8YzcfdLDQgPVj85xhpp0DghdWRUeuzIDcDW40aMsGQLZX9QLbiR:KGr8ocfdL0w5shpwf40lsGQ6biR
                                                                                                                                                                                                                                            MD5:F4948ADEA7D9F60748DE8B427AB85684
                                                                                                                                                                                                                                            SHA1:101AD5424E182236EB7F537F17CE846C917CED27
                                                                                                                                                                                                                                            SHA-256:749059834143BCD5BDCEA13FC863C8B6587A89D6DFC84CD5017A98DF190DEFBD
                                                                                                                                                                                                                                            SHA-512:49847CA1A78BC100739B3AFC8A0D607AC37E340CEBBB0C04B2C067CDBDD6ED33AC5557214282699A89E39F4B8BB3A8B6383FC0A25C19265089E09B08765EA693
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDIO.#define _INC_STDIO..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#define BUFSIZ 512.#define _NFILE _NSTREAM_.#define _NSTREAM_ 512.#define _IOB_ENTRIES 20.#define EOF (-1)..#ifndef _FILE_DEFINED. struct _iobuf {. char *_ptr;. int _cnt;. char *_base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char *_tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifdef _POSIX_.#define _P_tmpdir "/".#define _wP_tmpdir L"/".#else.#define _P_tmpdir "\\".#define _wP_tmpdir L"\\".#endif..#define L_tmpnam (sizeof(_P_tmpdir) + 12)..#ifdef _POSIX_.#define L_ctermid 9.#define L_cuserid 32.#endif..#define SEEK_CUR 1.#define SEEK_END 2.#define SEEK_SET 0..#define STDIN_FILENO

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-BR785.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3146
                                                                                                                                                                                                                                            Entropy (8bit):5.109358717547865
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GjF4XfZlIPU0rBLeGwDO0QZFxI2bMCaZSpEhW8bxv:CivoPU0rBLeRDO0QfxI2YCaZZhNl
                                                                                                                                                                                                                                            MD5:DEEC7C35F77EC8E22074667641CA8851
                                                                                                                                                                                                                                            SHA1:8CCE6B663A9A04B3C13AA6621B0798E487A8A88E
                                                                                                                                                                                                                                            SHA-256:67A827ACF4E09653AFB5D18F2ECAA5FCDFB7471D8A5B8197C2F33D06E8462F84
                                                                                                                                                                                                                                            SHA-512:8DE2B82B0579E6C37546A26BC1AB5D7603090E815D8CE728474B1405339AB4EF4F0794DF19FF4CC3780AA7259288D4D93FD50B0E9C63D413FF22AD5E72BFCBE5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _FENV_H_.#define _FENV_H_..#include <_mingw.h>../* FPU status word exception flags */.#define FE_INVALID.0x01.#define FE_DENORMAL.0x02.#define FE_DIVBYZERO.0x04.#define FE_OVERFLOW.0x08.#define FE_UNDERFLOW.0x10.#define FE_INEXACT.0x20.#define FE_ALL_EXCEPT (FE_INVALID | FE_DENORMAL | FE_DIVBYZERO \... | FE_OVERFLOW | FE_UNDERFLOW | FE_INEXACT)../* FPU control word rounding flags */.#define FE_TONEAREST.0x0000.#define FE_DOWNWARD.0x0400.#define FE_UPWARD.0x0800.#define FE_TOWARDZERO.0x0c00../* The MXCSR exception flags are the same as the. FE flags. */.#define __MXCSR_EXCEPT_FLAG_SHIFT 0../* How much to shift FE status word exception flags. to get MXCSR rounding flags, */.#define __MXCSR_ROUND_FLAG_SHIFT 3..#ifndef RC_INVOKED./*. For now, support only for t

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-CIURU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                            Entropy (8bit):4.845158903423087
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:9SahrQ/tJUaRaV/f7WtxfeiZDHy6U4diocGLIvHKLhfyW7Ja0+8:9sJlS6H
                                                                                                                                                                                                                                            MD5:7E3AC3220BF883DA2DB8CDC7B8100D0B
                                                                                                                                                                                                                                            SHA1:666E6F91306EF6412AE912FA386B3DECC6332AD5
                                                                                                                                                                                                                                            SHA-256:D5C02C22653784792EEFF04CC453467BA22C214D9ACE876127EAB5FCCCBCA762
                                                                                                                                                                                                                                            SHA-512:1E27E9E73C5D3FBEC7CE41CB3B5FD6615BACC416991321BCE22B599150902352CF60078CD447BBBBD49F3106254C5E88E3FB01CA7DE62DA9A4DEDB6FD60F9B7A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STRING.#define _INC_STRING..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _NLSCMP_DEFINED.#define _NLSCMP_DEFINED.#define _NLSCMPERROR 2147483647.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void *__cdecl _memccpy(void *_Dst,const void *_Src,int _Val,size_t _MaxCount);. _CONST_RETURN void *__cdecl memchr(const void *_Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void *_Buf1,const void *_Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void *_Buf1,const void *_Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void *_Buf1,const void *_Bu

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-CLTQ6.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1410
                                                                                                                                                                                                                                            Entropy (8bit):5.11838654592129
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDZ8CF1niJLkkutU0IdH6lO7baol3fRfUJhBJXs:Gi4YeH8915s
                                                                                                                                                                                                                                            MD5:B81E5A965ABD076FB52DE6DFA22A78C4
                                                                                                                                                                                                                                            SHA1:DC11ACF6A38871E60D79108DAD6C3156715F05E7
                                                                                                                                                                                                                                            SHA-256:7C8494FE57D944773861C4C1CC1F2B46B3111144A24BF505B3D47B32F0AC1E8A
                                                                                                                                                                                                                                            SHA-512:8F3057882753150FEFA734897ECFD8DC4082580E856947910FCD891D744651706338A7DF78C1DCF1C7E54EE79EA2A6E8D2646BE9DAC92EF301D7347801F04273
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_ERRNO.#define _INC_ERRNO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRT_ERRNO_DEFINED.#define _CRT_ERRNO_DEFINED. _CRTIMP extern int *__cdecl _errno(void);.#define errno (*_errno()).. errno_t __cdecl _set_errno(int _Value);. errno_t __cdecl _get_errno(int *_Value);.#endif..#define EPERM 1.#define ENOENT 2.#define ESRCH 3.#define EINTR 4.#define EIO 5.#define ENXIO 6.#define E2BIG 7.#define ENOEXEC 8.#define EBADF 9.#define ECHILD 10.#define EAGAIN 11.#define ENOMEM 12.#define EACCES 13.#define EFAULT 14.#define EBUSY 16.#define EEXIST 17.#define EXDEV 18.#define ENODEV 19.#define ENOTDIR 20.#define EISDIR 21.#define ENFILE 23.#define EMFILE 24.#define ENOTTY 25.#define EFBIG 27.#define ENOSPC 28.#define ESPIPE 29.#define EROFS 30.#de

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-F0SFA.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1439
                                                                                                                                                                                                                                            Entropy (8bit):5.2295620824781714
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDaGduHH7PPW3ep0m3Vp0GrHt+5p0CKpmucLNw/HHsuHfgpbrRD:GRdm3emm3Vm+HOmCKmC1fgdp
                                                                                                                                                                                                                                            MD5:9C022D741996DB6D32411BFEF4EADB41
                                                                                                                                                                                                                                            SHA1:4BA93D77927EB8CFDCFE07F56D6EDADE180AF1DD
                                                                                                                                                                                                                                            SHA-256:3AB7EDEC5E55840C35BE252BAD52236955C3B4F9143810CDB1F09C34510EB8C4
                                                                                                                                                                                                                                            SHA-512:E448608BFECB770A087CB19934A1B45A5C564EA10BDF5A40BBB250F472830ECEE4990C669E90E495ECB5D4E48C3871CC2A33CE84F2D38524449FC9F5FD501DA0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef __ASSERT_H_.#define __ASSERT_H_..#include <_mingw.h>.#ifdef __cplusplus.#include <stdlib.h>.#endif..#ifdef NDEBUG.#ifndef assert.#define assert(_Expression) ((void)0).#endif.#else..#ifndef _CRT_TERMINATE_DEFINED.#define _CRT_TERMINATE_DEFINED. void __cdecl __MINGW_NOTHROW exit(int _Code) __MINGW_ATTRIB_NORETURN;. _CRTIMP void __cdecl __MINGW_NOTHROW _exit(int _Code) __MINGW_ATTRIB_NORETURN;.#if !defined __NO_ISOCEXT /* extern stub in static libmingwex.a */./* C99 function name */.void __cdecl _Exit(int) __MINGW_ATTRIB_NORETURN;.__CRT_INLINE __MINGW_ATTRIB_NORETURN void __cdecl _Exit(int status).{ _exit(status); }.#endif..#pragma push_macro("abort").#undef abort. void __cdecl __declspec(noreturn) abort(void);.#pragma pop_macro("abort")..#endif..#ifdef __cplusplus.ext

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-GNGMP.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):176
                                                                                                                                                                                                                                            Entropy (8bit):4.607652660491414
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:YDC60AhCWNRSh4Hf9OKhW70rAcM05eB70AUrEtvQ7DM0zU2kx4Cv:mp0AnRoCkKu0McM0sF0AUn7f4Tv
                                                                                                                                                                                                                                            MD5:7D294F4EC2C9640974803A61153EF3DD
                                                                                                                                                                                                                                            SHA1:3BC244518F863B754A97CA1B756580974C0D4356
                                                                                                                                                                                                                                            SHA-256:5252824225DDC486B0460677F765E4157AF5D3ED7ACD65B310A4045EAFB56AF7
                                                                                                                                                                                                                                            SHA-512:FF09177DCD695A185D66AFA8405EB7BF0883D4C1E6507F00A12CD958562E2F0444867F6DABDEE6E50CD5977897E4D878F31CB51888BA6878829C96CBF80FB283
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _STDBOOL_H.#define _STDBOOL_H../* ISOC99 boolean */..#define bool._Bool.#define true.1.#define false.0.#define __bool_true_false_are_defined 1..#endif /* _STDBOOL_H */.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-H4510.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):304
                                                                                                                                                                                                                                            Entropy (8bit):4.976431807239841
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2n2ADbA96Iy/KTMk:UJJISFcShcFP+4BbHYPSN
                                                                                                                                                                                                                                            MD5:DDA4463DA15121ED7AD4F091FBF61DFF
                                                                                                                                                                                                                                            SHA1:84B4C4973306EF725C3F61446AB891CAC6AA66A4
                                                                                                                                                                                                                                            SHA-256:2E6AB359559319A11A80F8F52AA0472CD0B141137F3A1EAA18C40D8827DC51D4
                                                                                                                                                                                                                                            SHA-512:D3417CF7702A17F0F327CBAF8D167D7830A2955C19D553893329696CDF2312707595CF0F6DDAA36EA18D0CEA41F24E6FA9C15AC14D5BC567BC25A1CC81B733FE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_VADEFS.#define _INC_VADEFS..//!__TINYC__: GNUC specific stuff removed..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-HKILU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3867
                                                                                                                                                                                                                                            Entropy (8bit):5.235190435579294
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:hINzkdpqiPK62I7m503BDSX92h1Mjw9dQZOpxrW7qcvshO+RgA2CRu/PXOE:hINzkdpqiPKdI7m503FSXUhOjw9Fpxrs
                                                                                                                                                                                                                                            MD5:8BF97DC43B347CBCF622768EF43090EF
                                                                                                                                                                                                                                            SHA1:E6BE2C1B1FE50C19BCD2814E3827C7D94680E51B
                                                                                                                                                                                                                                            SHA-256:B6164EB7FAE4A12163251492F7F4E56CC50D146EC7A2F5640D86ECA4D095046F
                                                                                                                                                                                                                                            SHA-512:F2F1A16A1D719B10A20B8BE8B5046E151C50792D8D07A2E7F6BC8EB0D53FFCE7E66E53934E688FD1C3FDFE00545BF203267FB59CBD289AD92F3786E473F8198F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SETJMP.#define _INC_SETJMP..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#if (defined(_X86_) && !defined(__x86_64))..#define _JBLEN 16.#define _JBTYPE int.. typedef struct __JUMP_BUFFER {. unsigned long Ebp;. unsigned long Ebx;. unsigned long Edi;. unsigned long Esi;. unsigned long Esp;. unsigned long Eip;. unsigned long Registration;. unsigned long TryLevel;. unsigned long Cookie;. unsigned long UnwindFunc;. unsigned long UnwindData[6];. } _JUMP_BUFFER;.#elif defined(__ia64__). typedef _CRT_ALIGN(16) struct _SETJMP_FLOAT128 {. __int64 LowPart;. __int64 HighPart;. } SETJMP_FLOAT128;..#define _JBLEN 33. typedef SETJMP_FLOAT128 _JBTYPE;.. typedef struct __JUMP_BUFFER {..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-I08CQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):355
                                                                                                                                                                                                                                            Entropy (8bit):4.9174278150037285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2Ti2F0A/ivi+M8WjTffBX5FoKtn+cs:UJJISFcShcFP+4B6Xr/qi+MHjjfBcKta
                                                                                                                                                                                                                                            MD5:8C659FCB5BA111C2A40716A84A2540D8
                                                                                                                                                                                                                                            SHA1:20069AF3A3805CF4CB05339F7A7A860F04A1E4B9
                                                                                                                                                                                                                                            SHA-256:07858857F4EED0A61DF94BEB1A9D678B53FC3D67A0B0E8936155F85DDBCD1DCC
                                                                                                                                                                                                                                            SHA-512:D1B19DEC523C79320BB3380F29981A49EFB178F06C0538BCE0A5B36AFEABEC9BE0F2A9D02436EDF2AC0970CB14B175B3387BBB14A1E5F62EEC9971C0C7648A99
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _VARARGS_H.#define _VARARGS_H..#error "TinyCC no longer implements <varargs.h>.".#error "Revise your code to use <stdarg.h>."..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-I5F7F.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11130
                                                                                                                                                                                                                                            Entropy (8bit):4.886603456377803
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:R9IFnJJzpoJItwJ+Y31t1d1uF8sFX9B17lHLQWq4QcHyQA3sG1:XI4IJ2WzPw
                                                                                                                                                                                                                                            MD5:6A61E54AD2614BA528414C7B69147CAF
                                                                                                                                                                                                                                            SHA1:242479133484E15A2AF816D95DDB053835BF4C64
                                                                                                                                                                                                                                            SHA-256:DE7161F85835D98B38FE6A19EF8973DCAF58EC237B1C91CF05AC535B2FF3845F
                                                                                                                                                                                                                                            SHA-512:468702A606E20FFA893054F676C56DFE6EB3D28A002BAE143298422AB388A2F2F78E318714F5274BC9EBD243863F5228D5EBEAD5F31D892E96D8742C8E6846A1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_CONIO.#define _INC_CONIO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP char *_cgets(char *_Buffer);. _CRTIMP int __cdecl _cprintf(const char *_Format,...);. _CRTIMP int __cdecl _cputs(const char *_Str);. _CRTIMP int __cdecl _cscanf(const char *_Format,...);. _CRTIMP int __cdecl _cscanf_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _getch(void);. _CRTIMP int __cdecl _getche(void);. _CRTIMP int __cdecl _vcprintf(const char *_Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_p(const char *_Format,...);. _CRTIMP int __cdecl _vcprintf_p(const char *_Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_l(const char *_Format,_loc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-IOSNS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2686
                                                                                                                                                                                                                                            Entropy (8bit):5.279528518541247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GXFLawQcx1ZvUTc/5p3C8QcvAv1p3R0C8+Rve/KQ1i5/o4XqzOvQQHc8/Y:sn91ZgcrCkvQv0C8ksd4na
                                                                                                                                                                                                                                            MD5:21CE377183014C3535643C9050306A33
                                                                                                                                                                                                                                            SHA1:41B25206EDD6309884312FD70026096C35A6DBEB
                                                                                                                                                                                                                                            SHA-256:39C0761F0E43D7B936B9B81C85673DD82896EBFA66E9F1B9A19B45F34E4CD52A
                                                                                                                                                                                                                                            SHA-512:3B0FA5D6EBB7AC47694C7D04B4835AF6C089344F7F8337DB74B34E3B46A1792295224DC232FAC1FD0DB482FC32C8A6A4BFCAF4F39C35DCCD98600181C314B43D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#ifndef _INC_LIMITS.#define _INC_LIMITS../*.* File system limits.*.* TODO: NAME_MAX and OPEN_MAX are file system limits or not? Are they the.* same as FILENAME_MAX and FOPEN_MAX from stdio.h?.* NOTE: Apparently the actual size of PATH_MAX is 260, but a space is.* required for the NUL. TODO: Test?.*/.#define PATH_MAX.(259)..#define CHAR_BIT 8.#define SCHAR_MIN (-128).#define SCHAR_MAX 127.#define UCHAR_MAX 0xff..#define CHAR_MIN SCHAR_MIN.#define CHAR_MAX SCHAR_MAX..#define MB_LEN_MAX 5.#define SHRT_MIN (-32768).#define SHRT_MAX 32767.#define USHRT_MAX 0xffff.#define INT_MIN (-2147483647 - 1).#define INT_MAX 2147483647.#define UINT_MAX 0xffffffff.#define LONG_MIN (-2147483647L - 1).#define LONG_MAX 2147483647L.#define ULONG_MAX 0xffffffffUL.#def

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-JJBTV.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):952
                                                                                                                                                                                                                                            Entropy (8bit):4.981227039868006
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDadJeDoxsClLEdPQq15Fo30wLwNOk60:GYo6XDQsLp
                                                                                                                                                                                                                                            MD5:EF5C7267DF270272BFA8F8EBD1B516F2
                                                                                                                                                                                                                                            SHA1:1E3F8A9AFD814EFA8CF7C88DC480E9914A5BC570
                                                                                                                                                                                                                                            SHA-256:84064B17E501D691C43D47E45B112C2884DB467417910B5FA1482B72342BADFB
                                                                                                                                                                                                                                            SHA-512:8CA2B0E08B66EAA843FC7AD0F8F4063450A469914819A637AA3F8CAC39DD38E32CC0403F2B04F767AE486934026585B56F93544C8A1F5D92CCE32CE84A4506F4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* . * dir.h. *. * This file OBSOLESCENT and only provided for backward compatibility.. * Please use io.h instead.. *. * This file is part of the Mingw32 package.. *. * Contributors:. * Created by Colin Peters <colin@bird.fu.is.saga-u.ac.jp>. * Mumit Khan <khan@xraylith.wisc.edu>. *. * THIS SOFTWARE IS NOT COPYRIGHTED. *. * This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. *. * This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. *. */..#include <io.h>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-JMH80.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9755
                                                                                                                                                                                                                                            Entropy (8bit):5.0535405224800884
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:aK0sBzLLoy8q3JHZDrs+UAt0g7WnBeaIlzjD:EALLb8ars+Flzf
                                                                                                                                                                                                                                            MD5:22E5A00491E32D15B40B196397AD01C1
                                                                                                                                                                                                                                            SHA1:B0DB6FCBF4ABD2F4FDEA2771399C1E502D9F8106
                                                                                                                                                                                                                                            SHA-256:4CFAAA43B3F7414984126E8B1CDF65F9DAC0EF68D9A3396BE0B8828376A74A6B
                                                                                                                                                                                                                                            SHA-512:28839104776441738233334A20DE6CE3ADA51179FB50366C27AB60432949FC78E1CCF735D2E80216F8779D84328634005C322D0010875E8FE0FF33D699ECC114
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_CTYPE.#define _INC_CTYPE..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func().(_pctype).#else.#define __pctype_func().(*_imp___pctype).#endif.#endif..#ifndef _pctype.#ifdef _MSVCRT_. extern unsigned short *_pctype;.#else. extern unsigned short **_imp___pctype;.#define _pctype (*_imp___pctype).#endif.#endif..#endif.#endif..#ifndef _CRT_WCTYPEDATA_DEFINED.#define _CRT_WCTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS.#ifndef _wctype.#ifdef _MSVCRT_. extern unsigned short *_wctype;.#else. extern unsigned short **_im

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-JP1J3.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1269
                                                                                                                                                                                                                                            Entropy (8bit):5.067511244355359
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDeLwFq64bCszOD1zr/Aob1UBFv1tDaMLQHy2RoP/17FN:GOFq6UkybLGMLgyx/17z
                                                                                                                                                                                                                                            MD5:478ADD63D2C741D03A60A11BDC4FC0D3
                                                                                                                                                                                                                                            SHA1:E9E0C857D2C409F23C346D81B77C5634F1C395AB
                                                                                                                                                                                                                                            SHA-256:FBD94F945A57165AC897BDBACD2A861B1351E7850FA76752703C0A622E0646FA
                                                                                                                                                                                                                                            SHA-512:BCCC563718B1A03E93E5BF8CF0D79BB3128A3FC1FDD6FBC17792CBAF3C5DE70DE06EC2F88D8EED7105FF62056E32E9A79570F5890E75F4443033421D283B2FEC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#include <io.h>..#ifndef _INC_FCNTL.#define _INC_FCNTL..#define _O_RDONLY 0x0000.#define _O_WRONLY 0x0001.#define _O_RDWR 0x0002.#define _O_APPEND 0x0008.#define _O_CREAT 0x0100.#define _O_TRUNC 0x0200.#define _O_EXCL 0x0400.#define _O_TEXT 0x4000.#define _O_BINARY 0x8000.#define _O_WTEXT 0x10000.#define _O_U16TEXT 0x20000.#define _O_U8TEXT 0x40000.#define _O_ACCMODE (_O_RDONLY|_O_WRONLY|_O_RDWR)..#define _O_RAW _O_BINARY.#define _O_NOINHERIT 0x0080.#define _O_TEMPORARY 0x0040.#define _O_SHORT_LIVED 0x1000..#define _O_SEQUENTIAL 0x0020.#define _O_RANDOM 0x0010..#if !defined(NO_OLDNAMES) || defined(_POSIX).#define O_RDONLY _O_RDONLY.#define O_WRONLY _O_WRONLY.#define O_RDWR _O_RDWR.#define O_APPEND _O_APPEND.#define O_CREAT _O_CREAT.#define O_TRUNC _O_TRUNC

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-K8SDA.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9091
                                                                                                                                                                                                                                            Entropy (8bit):5.046593382105061
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:kVIYQ03tIPjxoNimr4mJ6hIO0XtcsQQ05vQTcsBOdFS3b6dyntql+:kVIYQ03tIPjxoNimr4mJ6hIOmcsQQ05E
                                                                                                                                                                                                                                            MD5:F06EDAF6AB750607C33C37BFE50B2EB2
                                                                                                                                                                                                                                            SHA1:CA3AFC7781760D84432B06567AFBDA24587757DD
                                                                                                                                                                                                                                            SHA-256:6947C954F2AF676E66CC38D64B1A165428734000E2E272F883C2D74A85B82020
                                                                                                                                                                                                                                            SHA-512:9926B19FBD4B30ECF6682AE5945401E4387D2B5CE02D7643B51C660462B761B08F52A99F2B7DA73B574C7BC6388CD23CA3ED8451A3CF2B3501AD217925A503EB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_PROCESS.#define _INC_PROCESS..#include <_mingw.h>../* Includes a definition of _pid_t and pid_t */.#include <sys/types.h>..#ifndef _POSIX_.#ifdef __cplusplus.extern "C" {.#endif..#define _P_WAIT 0.#define _P_NOWAIT 1.#define _OLD_P_OVERLAY 2.#define _P_NOWAITO 3.#define _P_DETACH 4.#define _P_OVERLAY 2..#define _WAIT_CHILD 0.#define _WAIT_GRANDCHILD 1.. _CRTIMP uintptr_t __cdecl _beginthread(void (__cdecl *_StartAddress) (void *),unsigned _StackSize,void *_ArgList);. _CRTIMP void __cdecl _endthread(void);. _CRTIMP uintptr_t __cdecl _beginthreadex(void *_Security,unsigned _StackSize,unsigned (__stdcall *_StartAddress) (void *),void *_ArgList,unsigned _InitFlag,unsigned *_ThrdAddr);. _CRTIMP void __cdecl _endthreadex(unsigned _Retval);..#ifndef _CRT_TERMINATE_DE

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-KJV2L.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10222
                                                                                                                                                                                                                                            Entropy (8bit):5.118611530215232
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:cwxjJoLCBGnjq/Kn4aq3qvsbLJKr7nnJik1gngZxl9e7PpTGO+HT7R8AitqazIh5:cwzbLJyLnJ6O8PpTGOEiNzIhIbIXP3JF
                                                                                                                                                                                                                                            MD5:ACE688BCE0201B3B8BC3B7AF3CEC1BA7
                                                                                                                                                                                                                                            SHA1:7B967DE03772076207537292C4163994D4EAD095
                                                                                                                                                                                                                                            SHA-256:FACA8509C87FAE987A5E98CDC95171E036895037427D12930E2A83092D23FBB5
                                                                                                                                                                                                                                            SHA-512:A83753F6A1B82BCDFCF0B948C93F2E09A0A13105A112C161ABAD6DE84162DA67600CF5458FF51264DDC462077033DE3C8496E7B2251831871005D747AE58A24A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/* tccdefs.h.... Nothing is defined before this file except target machine, target os.. and the few things related to option settings in tccpp.c:tcc_predefs()..... This file is either included at runtime as is, or converted and.. included as C-strings at compile-time (depending on CONFIG_TCC_PREDEFS)..... Note that line indent matters:.... - in lines starting at column 1, platform macros are replaced by.. corresponding TCC target compile-time macros. See conftest.c for.. the list of platform macros supported in lines starting at column 1..... - only lines indented >= 4 are actually included into the executable,.. check tccdefs_.h...*/....#if __SIZEOF_POINTER__ == 4.. /* 32bit systems. */..#if defined TARGETOS_OpenBSD.. #define __SIZE_TYPE__ unsigned long.. #define __PTRDIFF_TYPE__ long..#else.. #define __SIZE_TYPE__ unsigned int.. #define __PTRDIFF_TYPE__ int..#endif.. #define __ILP32__ 1.. #define __INT64_TYPE__ long long..#el

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-N738R.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20426
                                                                                                                                                                                                                                            Entropy (8bit):5.091356495974476
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:X5I7a44IVaadf7trkr6vrRcbCGX8XnaTjWb5:Uvf7trkr6vrRHaTjWb5
                                                                                                                                                                                                                                            MD5:53D74BF044942015FEC4AFD293D2F9A8
                                                                                                                                                                                                                                            SHA1:010AB014E3B81B3A7E2D1D87FF0281A8736A4ABC
                                                                                                                                                                                                                                            SHA-256:5BBA095A2D22A6BC0670F73BFEBBA63CFEC65F8B7C248E84E36B3D7EDE0A4F3C
                                                                                                                                                                                                                                            SHA-512:64B66F0D610D37E6F55702130FAD39F39D30F44D33221C6A985CD03948968D4C4CAFB7676402A9A4A029C8539EFBFA5801C0D1BCBF667B876F3E7BB08F9BF89F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDLIB.#define _INC_STDLIB..#include <_mingw.h>.#include <limits.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#define EXIT_SUCCESS 0.#define EXIT_FAILURE 1..#ifndef _ONEXIT_T_DEFINED.#define _ONEXIT_T_DEFINED.. typedef int (__cdecl *_onexit_t)(void);..#ifndef NO_OLDNAMES.#define onexit_t _onexit_t.#endif.#endif..#ifndef _DIV_T_DEFINED.#define _DIV_T_DEFINED.. typedef struct _div_t {. int quot;. int rem;. } div_t;.. typedef struct _ldiv_t {. long quot;. long rem;. } ldiv_t;.#endif..#ifndef _CRT_DOUBLE_DEC.#define _CRT_DOUBLE_DEC..#pragma pack(4). typedef struct {. unsigned char ld[10];. } _LDOUBLE;.#pragma pack()..#defin

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-O9Q8C.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):345
                                                                                                                                                                                                                                            Entropy (8bit):4.819819315483337
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1qTVSEDbA1CAAqC:UJJISFcShcFP+4B7SFRClV1qDD8CAAqC
                                                                                                                                                                                                                                            MD5:534517144E5B9ED662526771BB5D7E13
                                                                                                                                                                                                                                            SHA1:2D1801E4179E2A6E5914764D944A9C472BF65E99
                                                                                                                                                                                                                                            SHA-256:43956946AEFEE50E01FDD4D54A6C597418ABCB02251F9D7695ED7039FD7A5FF6
                                                                                                                                                                                                                                            SHA-512:533F30D3288C2B827D29210C6890D600678DB4F67B9FFAB27046E5CA3931BC119DE4AF93FFA63929DCD9D7C0BABD69A25E7F52E697272F3226ED198C93A9A8CD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * mem.h maps to string.h. */.#ifndef.__STRICT_ANSI__.#include <string.h>.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-OL6VE.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1090
                                                                                                                                                                                                                                            Entropy (8bit):5.185707945606799
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDLDhTwNeehqAaZzTcvYRkvF76bUge/xXmy:GyDCHcOV6bULZv
                                                                                                                                                                                                                                            MD5:3B6FBC94238DF0FD001B04D55BC899DB
                                                                                                                                                                                                                                            SHA1:231E18CE6A5488B2353FB9EF052FD6677C2CF555
                                                                                                                                                                                                                                            SHA-256:3AFEA4AE85C68987FE59F40592AC5EA3EF1049B4FB72612BB185358D628E2DEC
                                                                                                                                                                                                                                            SHA-512:28BA3ED6CC9511F17798822FA81A2D16DA17CA4AF9DA64F3EDC9170FBB883801BF07390214C54B58A32251E6A1C3BB359CB76E892DDB77FBF8C1BF3985E13E5E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_DOS.#define _INC_DOS..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED.. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif..#define _A_NORMAL 0x00.#define _A_RDONLY 0x01.#define _A_HIDDEN 0x02.#define _A_SYSTEM 0x04.#define _A_SUBDIR 0x10.#define _A_ARCH 0x20..#ifndef _GETDISKFREE_DEFINED.#define _GETDISKFREE_DEFINED. _CRTIMP unsigned __cdecl _getdiskfree(unsigned _Drive,struct _diskfree_t *_DiskFree);.#endif..#if (defined(_X86_) && !defined(__x86_64)). void __cdecl _disable(void);. void __cdecl _enable(void);.#endif..#ifndef.NO_OLDNAMES.#de

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-OR7FQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):164
                                                                                                                                                                                                                                            Entropy (8bit):4.396200340591225
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:YRTvF08wB32DsxQGG+TSERKR9BeCTSERKRIHTSERKR7LsyodP1XGZovVOMD:oF08iGDsx9TSEIToCTSEIcTSEIVun4yJ
                                                                                                                                                                                                                                            MD5:623F15DB2D9075E9DE1E1E5217854933
                                                                                                                                                                                                                                            SHA1:247EBCAA4F74507EDC5E06E2382378561E67027E
                                                                                                                                                                                                                                            SHA-256:2C63CD52CD589A204C8E5F75B9179FD520BE1A0770A698303526BE4069613E3B
                                                                                                                                                                                                                                            SHA-512:34555DF799E9F54EFDFF3BE4498CF20565935A0D5A116D030475042E3BD1CEA9F949A8CC4D9DD5C320FD528879B6221CA70CA0B9068C1AC6381B55C4756D92C4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef celib_h..#define celib_h....typedef struct _cecs..{.. volatile int locked;.. volatile int threadif;.. volatile int lockcount; ..} cecs, *Pcecs;....#endif

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-PLNB1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5214
                                                                                                                                                                                                                                            Entropy (8bit):5.2821319558661655
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:y4bSZjA6r8VdQINtNy6XVqB4/mLErYQ015U/dIuvwQRbZBq35jU:9urrSXIzGdIuvwQR9YJo
                                                                                                                                                                                                                                            MD5:537BC027E86F7252D88B6BF2FE5B2F35
                                                                                                                                                                                                                                            SHA1:7F3361D220F96AD1B93669254937929F267CC333
                                                                                                                                                                                                                                            SHA-256:7307FF330B8D7954D548E19E45887ED64DE36DA5BEE1FDA2CC021F0C1C1892BD
                                                                                                                                                                                                                                            SHA-512:3D7693F46FE1272DECBA8EFB6A01853786419055CF338CC900C9FE3EC1B795BA25E16878A5D53261BF3BC3BAB7525110B6F1844501D5FB6BE45C57B5D277F625
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _MALLOC_H_.#define _MALLOC_H_..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _MM_MALLOC_H_INCLUDED.#define _MM_MALLOC_H_INCLUDED.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _WIN64.#define _HEAP_MAXREQ 0xFFFFFFFFFFFFFFE0.#else.#define _HEAP_MAXREQ 0xFFFFFFE0.#endif..#ifndef _STATIC_ASSERT.#define _STATIC_ASSERT(expr) extern void __static_assert_t(int [(expr)?1:-1]).#endif../* Return codes for _heapwalk() */.#define _HEAPEMPTY (-1).#define _HEAPOK (-2).#define _HEAPBADBEGIN (-3).#define _HEAPBADNODE (-4).#define _HEAPEND (-5).#define _HEAPBADPTR (-6)../* Values for _heapinfo.useflag */.#define _FREEENTRY 0.#define _USEDENTRY 1..#ifndef _HEAPINFO_DEFINED.#define _HEAPINFO_DEFINED. /* The structure used to walk through the heap with _heapwalk.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-Q7RFI.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34132
                                                                                                                                                                                                                                            Entropy (8bit):5.065285191271868
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:2186Orc7LIJ8SNgVx6eG17k8MGOHlE4eGP0+aILsGQ86jWIwF2iiEYbS:2IcE8SNgVx61JC6jry2E
                                                                                                                                                                                                                                            MD5:D6B25F8E3068967751493431B36C4248
                                                                                                                                                                                                                                            SHA1:3145ED71F286525D1FF492AE920B30694123259E
                                                                                                                                                                                                                                            SHA-256:C9BF12E02A2AB0783ED1C66DFE43DE43C402B33906CADA9B1157502A82C7C3E4
                                                                                                                                                                                                                                            SHA-512:02A480389CECC909978130585609F57D03728726E72E5FEE89874ACCA4122D971D74FC615949F8675513EDCFE3198201AD0118F795B147C6FCA10D28E8856645
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_WCHAR.#define _INC_WCHAR..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WCHAR_MIN /* also at stdint.h */.#define WCHAR_MIN 0.#define WCHAR_MAX ((wchar_t) -1) /* UINT16_MAX */.#endif..#ifndef __GNUC_VA_LIST.#define __GNUC_VA_LIST. typedef __builtin_va_list __gnuc_va_list;.#endif..#ifndef _VA_LIST_DEFINED.#define _VA_LIST_DEFINED. typedef __gnuc_va_list va_list;.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _FILE_DEFINED. struct _iobuf {. char *_ptr;. int _cnt;. char *_base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char *_tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifndef _STDIO_DEFINED.#ifdef _WIN64. _CRTIMP FILE *__

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-QJL6L.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1402
                                                                                                                                                                                                                                            Entropy (8bit):4.8724440555000506
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:d19VSrcs/mbR/4Cm+iOwHCFFfJNn9DAP6V2OCB6E7LuNcWmY/CDGAsC:5VSrH/TCeCFD59DGJUEnhzY/6GA9
                                                                                                                                                                                                                                            MD5:8B03F5DA84F6175FB1213C1208BB0944
                                                                                                                                                                                                                                            SHA1:FB7A374705241EE8BA4C59C6BD4829A97B90FA55
                                                                                                                                                                                                                                            SHA-256:C91FFAAEF5231C6D7E744E0700F1F429C9CFAD88A4112FDD5ABABB701F3B5A4B
                                                                                                                                                                                                                                            SHA-512:038DA70FFDA4BF66CDF6D0D6792F51B140B0E6EEC8351A286A51D454A81E0571779E16985519DAB47F3B48E6102A54A40101634B86F556C95C2128DC6AED4283
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _STDDEF_H.#define _STDDEF_H..typedef __SIZE_TYPE__ size_t;.typedef __PTRDIFF_TYPE__ ssize_t;.typedef __WCHAR_TYPE__ wchar_t;.typedef __PTRDIFF_TYPE__ ptrdiff_t;.typedef __PTRDIFF_TYPE__ intptr_t;.typedef __SIZE_TYPE__ uintptr_t;..#ifndef __int8_t_defined.#define __int8_t_defined.typedef signed char int8_t;.typedef signed short int int16_t;.typedef signed int int32_t;.#ifdef __LP64__.typedef signed long int int64_t;.#else.typedef signed long long int int64_t;.#endif.typedef unsigned char uint8_t;.typedef unsigned short int uint16_t;.typedef unsigned int uint32_t;.#ifdef __LP64__.typedef unsigned long int uint64_t;.#else.typedef unsigned long long int uint64_t;.#endif.#endif..#ifndef NULL.#define NULL ((void*)0).#endif..#define offsetof(type, field) ((size_t)&((type *)0)->field)..void *alloca(size_t size);..#endif../* Older glibc require a wint_t from <stddef.h> (when requested. by __need_wint_t, as otherwise stddef.h isn't allowed to. define this type). Note that this must

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-R00DR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1583
                                                                                                                                                                                                                                            Entropy (8bit):5.223946000134317
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDPvH5BolYl9cEPXEDv5JOhS3zDOE/MVuTYE3tmV+Rv4fMBzN80FnPibwB:GWcqvvsDNzD9koS+94fQzN8OPibwDrhT
                                                                                                                                                                                                                                            MD5:A106C85866BF88A68510029349149B52
                                                                                                                                                                                                                                            SHA1:989F8BF922CAC5BEB03905A0E35C3C7B4B125C85
                                                                                                                                                                                                                                            SHA-256:045A031B376733ED7A685BC01709F5281403729FF7C601B913B2ACA2FE1493BB
                                                                                                                                                                                                                                            SHA-512:205611A36897D5A87EB54DA5C2C193680DAD95DDA01A55DCEF61665ED09EFD322A20F276D9419A64144941CF0B59339FF9D15C1A7A9C86DA60F140364EACFF73
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SIGNAL.#define _INC_SIGNAL..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _SIG_ATOMIC_T_DEFINED.#define _SIG_ATOMIC_T_DEFINED. typedef int sig_atomic_t;.#endif..#define NSIG 23..#define.SIGHUP.1./* hangup */.#define SIGINT 2.#define.SIGQUIT.3./* quit */.#define SIGILL 4.#define.SIGTRAP.5./* trace trap (not reset when caught) */.#define.SIGIOT.6./* IOT instruction */.#define.SIGABRT 6./* used by abort, replace SIGIOT in the future */.#define.SIGEMT.7./* EMT instruction */.#define SIGFPE 8.#define.SIGKILL.9./* kill (cannot be caught or ignored) */.#define.SIGBUS.10./* bus error */.#define SIGSEGV 11.#define.SIGSYS.12./* bad argument to system call */.#define.SIGPIPE.13./* write on a pipe with no one to read it */.#ifdef __USE_MINGW_ALARM.#def

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-SDMIC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2135
                                                                                                                                                                                                                                            Entropy (8bit):5.113182765405398
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GXWM0CJUOsxXX0MLOMMMRgusuLZum+3Pw+8yFGX7Mu1LkuLS91uuHeLWv:35TW/Vf5FS7Mu1IuLium6Wv
                                                                                                                                                                                                                                            MD5:5F6A3E42F8EB297B888B498D93437C3C
                                                                                                                                                                                                                                            SHA1:09729D7892A1ED36AFADDEC40674ACEB62B5FA88
                                                                                                                                                                                                                                            SHA-256:882626FA25DBC1B5903E6FD98CC8516F1E54C4E06945026653F05B38125DFF2C
                                                                                                                                                                                                                                            SHA-512:587BB7BE57DDA7DB0BF8C454A78DD67D850342D97BC7C99A9804D53FA7929EB42C1194E13456170C0902CA7A15C028A6C635879889F0AF6A9ED833C2E046B9EC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_LOCALE.#define _INC_LOCALE..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#define LC_ALL 0.#define LC_COLLATE 1.#define LC_CTYPE 2.#define LC_MONETARY 3.#define LC_NUMERIC 4.#define LC_TIME 5..#define LC_MIN LC_ALL.#define LC_MAX LC_TIME..#ifndef _LCONV_DEFINED.#define _LCONV_DEFINED. struct lconv {. char *decimal_point;. char *thousands_sep;. char *grouping;. char *int_curr_symbol;. char *currency_symbol;. char *mon_decimal_point;. char *mon_thousands_sep;. char *mon_grouping;. char *positive_sign;. char *negative_sign;. char int_frac_digits;. char frac_digits;. char p_cs_precedes;.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-SM06P.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3865
                                                                                                                                                                                                                                            Entropy (8bit):5.239566441223487
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:aOgQsLqPQLHbXTN6oYsNhd6vgAwFQCbTprO5BPPTeraG9n0WP/zgSRQh:aOgQO3hdE8KBPPTrGHU5
                                                                                                                                                                                                                                            MD5:DC2829239704CDD5A5109699666FA573
                                                                                                                                                                                                                                            SHA1:60C09E102F552444D59ED9ED474E667136C16DC0
                                                                                                                                                                                                                                            SHA-256:AB4BE7D34E7FA0E722F0948E0C90AD4D95B8A1EC649C2F186DFA387B57BE7833
                                                                                                                                                                                                                                            SHA-512:F3551AEF2A0FFE42A16F1A8BE26B2C2722E773A59D21B60B2454AB0B68B008402623F378D2AFAA30FEBA87F560475A52D2899E6D062BD7F88E22119B25231F17
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*. * _mingw.h. *. * This file is for TinyCC and not part of the Mingw32 package.. *. * THIS SOFTWARE IS NOT COPYRIGHTED. *. * This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. *. * This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. *. */..#ifndef __MINGW_H.#define __MINGW_H../* some winapi files define these before including _mingw.h --> */.#undef __cdecl.#undef _X86_.#undef WIN32./* <-- */..#include <stddef.h>.#include <stdarg.h>..#define __int8 char.#define __int16 short.#define __int32 int.#define __int64 long long.#define _HAVE_INT64..#define __cdecl.#define __declspec(x) __attribute__((x)).#define __unaligned __attribute__((packed)).#define __fastcall __attribute__((fastcall))..#define __MSVCRT__ 1.#undef _MSVCRT_

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-SUSSO.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1374
                                                                                                                                                                                                                                            Entropy (8bit):5.161015521868813
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:9Mz83vjoKY2mg/oCrPy+lUmCSh/PTtcmBSED9smlS1:9MEj+bkoCrqahXBPSEDWJ
                                                                                                                                                                                                                                            MD5:3B2E4B0C01E5B0B790F4F6751E977CC9
                                                                                                                                                                                                                                            SHA1:06DB05E1C73809CD442EF58F775A8E87D708421D
                                                                                                                                                                                                                                            SHA-256:C9BAAA478E3BA85897B781F7065B9E144FAACC8E81CAFA5A642B5D49C78434EB
                                                                                                                                                                                                                                            SHA-512:28DD57DC4360292B987D38A408771B5E1D5B423BFD9656BEE9DFA2F9BC19696AF63A7F90CD350C8445BB27C5049987D97D9530AB15F3697D37652A91AAA7F892
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _FLOAT_H_.#define _FLOAT_H_..#define FLT_RADIX 2../* IEEE float */.#define FLT_MANT_DIG 24.#define FLT_DIG 6.#define FLT_ROUNDS 1.#define FLT_EPSILON 1.19209290e-07F.#define FLT_MIN_EXP (-125).#define FLT_MIN 1.17549435e-38F.#define FLT_MIN_10_EXP (-37).#define FLT_MAX_EXP 128.#define FLT_MAX 3.40282347e+38F.#define FLT_MAX_10_EXP 38../* IEEE double */.#define DBL_MANT_DIG 53.#define DBL_DIG 15.#define DBL_EPSILON 2.2204460492503131e-16.#define DBL_MIN_EXP (-1021).#define DBL_MIN 2.2250738585072014e-308.#define DBL_MIN_10_EXP (-307).#define DBL_MAX_EXP 1024.#define DBL_MAX 1.7976931348623157e+308.#define DBL_MAX_10_EXP 308../* horrible intel long double */.#if defined __i386__ || defined __x86_64__..#define LDBL_MANT_DIG 64.#define LDBL_DIG 18.#define LDBL_EPSILON 1.08420217248550443401e-19L.#define LDBL_MIN_EXP (-16381).#define LDBL_MIN 3.36210314311209350626e-4932L.#define LDBL_MIN_10_EXP (-4931).#define LDBL_MAX_EXP 16384.#define LDBL_MAX 1.18973149535723176502e+4932L.#defin

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-U7L3I.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4782
                                                                                                                                                                                                                                            Entropy (8bit):5.146949090032166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:4+KnaNsLsNwnSTOXNXgXXXVX+1XPXmXIX6QXJX9XZXdwUSv:4+KA6O6XNXgXXXVXkXPXmXIXfXJX9XZK
                                                                                                                                                                                                                                            MD5:C238CFA11A44926BECD364AB35BFC821
                                                                                                                                                                                                                                            SHA1:54D68B8EF71D277BD5173E0AAC794D6EBDB00360
                                                                                                                                                                                                                                            SHA-256:E12D9C5BCBE4DFB96EA6C75410EA287917B3C24BFF9CD2E716D35E00C1D4906C
                                                                                                                                                                                                                                            SHA-512:C64F6A3B18D84C8498A2270E7152C4001D6D7EE1ACD04169F616A7808A05A02F34E2876BA0CB8D979AE75752109B50A65A66207C86FE936402BDA39AC93833C0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_WCTYPE.#define _INC_WCTYPE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef _WCTYPE_T_DEFINED. typedef unsigned short wint_t;. typedef unsigned short wctype_t;.#define _WCTYPE_T_DEFINED.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func() (_pctype).#else.#define __pctype_func() (*_imp___pctype).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\is-V5VS4.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3796
                                                                                                                                                                                                                                            Entropy (8bit):5.3190944253059405
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GdUcbUGSCnlAxeSeFkvSp2wCoIt6TcUEYEJ+CkbUHfXF0XQtVI:QTIGTWeFk6pw/6TOMvIfFsA+
                                                                                                                                                                                                                                            MD5:D236372CBA09E14C37B4E48F81BAEF83
                                                                                                                                                                                                                                            SHA1:11A3BFFAACEDFA1CAA4B4BB836CD95297A4ECC6D
                                                                                                                                                                                                                                            SHA-256:0098E51602C94F8A9702F4B776D3630F56EEC27ED67B9FC36D9204933B58AC4D
                                                                                                                                                                                                                                            SHA-512:D7C22525FBB97BF8950DB69645511420F1198ABE33F5D0FE07A5EE8DD6B5CDA07038B6DB71A2995C6F5EC1B85D8B98E4370330193132E95F2A65E3A847F04408
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_EXCPT.#define _INC_EXCPT..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif.. struct _EXCEPTION_POINTERS;..#ifndef EXCEPTION_DISPOSITION.#define EXCEPTION_DISPOSITION int.#endif.#define ExceptionContinueExecution 0.#define ExceptionContinueSearch 1.#define ExceptionNestedException 2.#define ExceptionCollidedUnwind 3..#if (defined(_X86_) && !defined(__x86_64)). struct _EXCEPTION_RECORD;. struct _CONTEXT;.. EXCEPTION_DISPOSITION __cdecl _except_handler(struct _EXCEPTION_RECORD *_ExceptionRecord,void *_EstablisherFrame,struct _CONTEXT *_ContextRecord,void *_DispatcherContext);.#elif defined(__ia64__).. typedef struct _EXCEPTION_POINTERS *Exception_info_ptr;. struct _EXCEPTION_RECORD;. struct _CONTEXT;. struct _DISP

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\limits.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2686
                                                                                                                                                                                                                                            Entropy (8bit):5.279528518541247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GXFLawQcx1ZvUTc/5p3C8QcvAv1p3R0C8+Rve/KQ1i5/o4XqzOvQQHc8/Y:sn91ZgcrCkvQv0C8ksd4na
                                                                                                                                                                                                                                            MD5:21CE377183014C3535643C9050306A33
                                                                                                                                                                                                                                            SHA1:41B25206EDD6309884312FD70026096C35A6DBEB
                                                                                                                                                                                                                                            SHA-256:39C0761F0E43D7B936B9B81C85673DD82896EBFA66E9F1B9A19B45F34E4CD52A
                                                                                                                                                                                                                                            SHA-512:3B0FA5D6EBB7AC47694C7D04B4835AF6C089344F7F8337DB74B34E3B46A1792295224DC232FAC1FD0DB482FC32C8A6A4BFCAF4F39C35DCCD98600181C314B43D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#ifndef _INC_LIMITS.#define _INC_LIMITS../*.* File system limits.*.* TODO: NAME_MAX and OPEN_MAX are file system limits or not? Are they the.* same as FILENAME_MAX and FOPEN_MAX from stdio.h?.* NOTE: Apparently the actual size of PATH_MAX is 260, but a space is.* required for the NUL. TODO: Test?.*/.#define PATH_MAX.(259)..#define CHAR_BIT 8.#define SCHAR_MIN (-128).#define SCHAR_MAX 127.#define UCHAR_MAX 0xff..#define CHAR_MIN SCHAR_MIN.#define CHAR_MAX SCHAR_MAX..#define MB_LEN_MAX 5.#define SHRT_MIN (-32768).#define SHRT_MAX 32767.#define USHRT_MAX 0xffff.#define INT_MIN (-2147483647 - 1).#define INT_MAX 2147483647.#define UINT_MAX 0xffffffff.#define LONG_MIN (-2147483647L - 1).#define LONG_MAX 2147483647L.#define ULONG_MAX 0xffffffffUL.#def

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\locale.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2135
                                                                                                                                                                                                                                            Entropy (8bit):5.113182765405398
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GXWM0CJUOsxXX0MLOMMMRgusuLZum+3Pw+8yFGX7Mu1LkuLS91uuHeLWv:35TW/Vf5FS7Mu1IuLium6Wv
                                                                                                                                                                                                                                            MD5:5F6A3E42F8EB297B888B498D93437C3C
                                                                                                                                                                                                                                            SHA1:09729D7892A1ED36AFADDEC40674ACEB62B5FA88
                                                                                                                                                                                                                                            SHA-256:882626FA25DBC1B5903E6FD98CC8516F1E54C4E06945026653F05B38125DFF2C
                                                                                                                                                                                                                                            SHA-512:587BB7BE57DDA7DB0BF8C454A78DD67D850342D97BC7C99A9804D53FA7929EB42C1194E13456170C0902CA7A15C028A6C635879889F0AF6A9ED833C2E046B9EC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_LOCALE.#define _INC_LOCALE..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#define LC_ALL 0.#define LC_COLLATE 1.#define LC_CTYPE 2.#define LC_MONETARY 3.#define LC_NUMERIC 4.#define LC_TIME 5..#define LC_MIN LC_ALL.#define LC_MAX LC_TIME..#ifndef _LCONV_DEFINED.#define _LCONV_DEFINED. struct lconv {. char *decimal_point;. char *thousands_sep;. char *grouping;. char *int_curr_symbol;. char *currency_symbol;. char *mon_decimal_point;. char *mon_thousands_sep;. char *mon_grouping;. char *positive_sign;. char *negative_sign;. char int_frac_digits;. char frac_digits;. char p_cs_precedes;.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\malloc.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5214
                                                                                                                                                                                                                                            Entropy (8bit):5.2821319558661655
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:y4bSZjA6r8VdQINtNy6XVqB4/mLErYQ015U/dIuvwQRbZBq35jU:9urrSXIzGdIuvwQR9YJo
                                                                                                                                                                                                                                            MD5:537BC027E86F7252D88B6BF2FE5B2F35
                                                                                                                                                                                                                                            SHA1:7F3361D220F96AD1B93669254937929F267CC333
                                                                                                                                                                                                                                            SHA-256:7307FF330B8D7954D548E19E45887ED64DE36DA5BEE1FDA2CC021F0C1C1892BD
                                                                                                                                                                                                                                            SHA-512:3D7693F46FE1272DECBA8EFB6A01853786419055CF338CC900C9FE3EC1B795BA25E16878A5D53261BF3BC3BAB7525110B6F1844501D5FB6BE45C57B5D277F625
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _MALLOC_H_.#define _MALLOC_H_..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _MM_MALLOC_H_INCLUDED.#define _MM_MALLOC_H_INCLUDED.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _WIN64.#define _HEAP_MAXREQ 0xFFFFFFFFFFFFFFE0.#else.#define _HEAP_MAXREQ 0xFFFFFFE0.#endif..#ifndef _STATIC_ASSERT.#define _STATIC_ASSERT(expr) extern void __static_assert_t(int [(expr)?1:-1]).#endif../* Return codes for _heapwalk() */.#define _HEAPEMPTY (-1).#define _HEAPOK (-2).#define _HEAPBADBEGIN (-3).#define _HEAPBADNODE (-4).#define _HEAPEND (-5).#define _HEAPBADPTR (-6)../* Values for _heapinfo.useflag */.#define _FREEENTRY 0.#define _USEDENTRY 1..#ifndef _HEAPINFO_DEFINED.#define _HEAPINFO_DEFINED. /* The structure used to walk through the heap with _heapwalk.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\math.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):23077
                                                                                                                                                                                                                                            Entropy (8bit):5.0910424086795425
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:lpwI012C9/SKSP4qROW8JuWucZBFRzWhHONMLPik9OeY:lpq2C9/FA4OOJr
                                                                                                                                                                                                                                            MD5:631F16C4A65CF2F47FA49C9220D9C500
                                                                                                                                                                                                                                            SHA1:330EADF08FDCB31747BF7C84182F2A5EECFA3FAB
                                                                                                                                                                                                                                            SHA-256:0BC33882BD2AF1E7D33C38C0160E2A0AE737836815360765750CDC7E98E5DFC5
                                                                                                                                                                                                                                            SHA-512:92EB690CA7D563269CEAEFFAC1F0FFBA6D010568431843F2DD82DCA7A1ACA0E6634C3335202ED5559FE631B0ED7C585DC1C3F5BB248FE3D571BA754B22B6AD5A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _MATH_H_.#define _MATH_H_..#if __GNUC__ >= 3.#pragma GCC system_header.#endif..#include <_mingw.h>..struct exception;..#pragma pack(push,_CRT_PACKING)..#define _DOMAIN 1.#define _SING 2.#define _OVERFLOW 3.#define _UNDERFLOW 4.#define _TLOSS 5.#define _PLOSS 6..#ifndef __STRICT_ANSI__.#ifndef.NO_OLDNAMES.#define DOMAIN _DOMAIN.#define SING _SING.#define OVERFLOW _OVERFLOW.#define UNDERFLOW _UNDERFLOW.#define TLOSS _TLOSS.#define PLOSS _PLOSS.#endif.#endif..#ifndef __STRICT_ANSI__.#define M_E 2.71828182845904523536.#define M_LOG2E 1.44269504088896340736.#define M_LOG10E 0.434294481903251827651.#define M_LN2 0.693147180559945309417.#define M_LN10 2.30258509299404568402.#define M_PI 3.14159265358979323846.#define M_PI_2 1.57079632679489661923.#define M_PI_4 0.785398163397

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\mem.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):345
                                                                                                                                                                                                                                            Entropy (8bit):4.819819315483337
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1qTVSEDbA1CAAqC:UJJISFcShcFP+4B7SFRClV1qDD8CAAqC
                                                                                                                                                                                                                                            MD5:534517144E5B9ED662526771BB5D7E13
                                                                                                                                                                                                                                            SHA1:2D1801E4179E2A6E5914764D944A9C472BF65E99
                                                                                                                                                                                                                                            SHA-256:43956946AEFEE50E01FDD4D54A6C597418ABCB02251F9D7695ED7039FD7A5FF6
                                                                                                                                                                                                                                            SHA-512:533F30D3288C2B827D29210C6890D600678DB4F67B9FFAB27046E5CA3931BC119DE4AF93FFA63929DCD9D7C0BABD69A25E7F52E697272F3226ED198C93A9A8CD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * mem.h maps to string.h. */.#ifndef.__STRICT_ANSI__.#include <string.h>.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\memory.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1233
                                                                                                                                                                                                                                            Entropy (8bit):5.1075312514305296
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDYqsS6s1UzFf5wNaCmwN0PK0PQvYaH2l2X:GlS6s1k5wNaRwNt95H2U
                                                                                                                                                                                                                                            MD5:29F62B1ADD26DC1AED3FAAD03FAC030D
                                                                                                                                                                                                                                            SHA1:6F605B9A153A987F2939AE6500D6391FDC107332
                                                                                                                                                                                                                                            SHA-256:B4341E188913A819FA3BF101078A95CA077780219373F424C39AD86C94E04B6F
                                                                                                                                                                                                                                            SHA-512:3D98E9F039DDA694A660BA7D2F7906FCD60016DC6A8FED78CEB7B191618318A68D34169B9480BA5727730F6BD6357A13FD02E0CDCA5439A45E06D2F0D61DABE0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_MEMORY.#define _INC_MEMORY..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CONST_RETURN.#define _CONST_RETURN.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void *__cdecl _memccpy(void *_Dst,const void *_Src,int _Val,size_t _MaxCount);. _CONST_RETURN void *__cdecl memchr(const void *_Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void *_Buf1,const void *_Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void *_Buf1,const void *_Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void *_Buf1,const void *_Buf2,size_t _Size);. void *__cdecl memcpy(void *_Dst,const void *_Src,size_t _Size);. void *__cdecl memset(void *_Dst,int _Val,si

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\process.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9091
                                                                                                                                                                                                                                            Entropy (8bit):5.046593382105061
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:kVIYQ03tIPjxoNimr4mJ6hIO0XtcsQQ05vQTcsBOdFS3b6dyntql+:kVIYQ03tIPjxoNimr4mJ6hIOmcsQQ05E
                                                                                                                                                                                                                                            MD5:F06EDAF6AB750607C33C37BFE50B2EB2
                                                                                                                                                                                                                                            SHA1:CA3AFC7781760D84432B06567AFBDA24587757DD
                                                                                                                                                                                                                                            SHA-256:6947C954F2AF676E66CC38D64B1A165428734000E2E272F883C2D74A85B82020
                                                                                                                                                                                                                                            SHA-512:9926B19FBD4B30ECF6682AE5945401E4387D2B5CE02D7643B51C660462B761B08F52A99F2B7DA73B574C7BC6388CD23CA3ED8451A3CF2B3501AD217925A503EB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_PROCESS.#define _INC_PROCESS..#include <_mingw.h>../* Includes a definition of _pid_t and pid_t */.#include <sys/types.h>..#ifndef _POSIX_.#ifdef __cplusplus.extern "C" {.#endif..#define _P_WAIT 0.#define _P_NOWAIT 1.#define _OLD_P_OVERLAY 2.#define _P_NOWAITO 3.#define _P_DETACH 4.#define _P_OVERLAY 2..#define _WAIT_CHILD 0.#define _WAIT_GRANDCHILD 1.. _CRTIMP uintptr_t __cdecl _beginthread(void (__cdecl *_StartAddress) (void *),unsigned _StackSize,void *_ArgList);. _CRTIMP void __cdecl _endthread(void);. _CRTIMP uintptr_t __cdecl _beginthreadex(void *_Security,unsigned _StackSize,unsigned (__stdcall *_StartAddress) (void *),void *_ArgList,unsigned _InitFlag,unsigned *_ThrdAddr);. _CRTIMP void __cdecl _endthreadex(unsigned _Retval);..#ifndef _CRT_TERMINATE_DE

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\conio_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1535
                                                                                                                                                                                                                                            Entropy (8bit):5.005173947475632
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDp5BUXLjIT0Cn0jIn0jQsY0eq0DY0PdMR0Mk3Z0ln0ln0fKY0xq0CY0u+:G4X+j41n8In8QsYbqgYKd00x+nknmKY1
                                                                                                                                                                                                                                            MD5:5BC78AA26AF6CE836F322CD5A432E368
                                                                                                                                                                                                                                            SHA1:1E99298161F0ADB4F7244EB5A067364DC5B47E91
                                                                                                                                                                                                                                            SHA-256:F7375E816739491FBAB39531C1D60A77B78FF9A162ABA17F817C773BF75F6508
                                                                                                                                                                                                                                            SHA-512:F1BFD5EF34A97E72EC474B2A2FECF4AC5FA1931E08845489623A7C699954B549FEDE1E4F93C815C0A9944A7D79601A9ED1342D47694528DAB54ADEAA5BBAB443
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _INC_CONIO_S.#define _INC_CONIO_S..#include <conio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _cgets_s(char *_Buffer,size_t _Size,size_t *_SizeRead);. _CRTIMP int __cdecl _cprintf_s(const char *_Format,...);. _CRTIMP int __cdecl _cscanf_s(const char *_Format,...);. _CRTIMP int __cdecl _cscanf_s_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s(const char *_Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_s_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s_l(const char *_Format,_locale_t _Locale,va_list _ArgList);..#ifndef _WCONIO_DEFINED_S.#define _WCONIO_DEFINED_S. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t *_Buffer,size_t _SizeInWords,

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\crtdbg_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):461
                                                                                                                                                                                                                                            Entropy (8bit):5.161018019410615
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BtsYzlAEG2UCqAhEGksdAwED:i2PSh0PDtJLUtNjOqD
                                                                                                                                                                                                                                            MD5:F0C359A5AA08A907A23D2C0C5AA68E5C
                                                                                                                                                                                                                                            SHA1:B487788EC6AA32458DF18F6D10F67573DE8FA16E
                                                                                                                                                                                                                                            SHA-256:03630EE83E7C921446A0790853FCADEB5A308553DD3C4ECDDD568CDA3167C0F1
                                                                                                                                                                                                                                            SHA-512:71BD41E6BD84BFFE34BEB8EF1B49C63358CB5D8E520972D57046D58E9D9FB6DEAE512E4CF5554337DA2510D6F3AFCD6C6D58124A30C4003F9E3A8F60C2FFA896
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _INC_CRTDBG_S.#define _INC_CRTDBG_S..#include <crtdbg.h>..#if defined(MINGW_HAS_SECURE_API)..#define _dupenv_s_dbg(ps1,size,s2,t,f,l) _dupenv_s(ps1,size,s2).#define _wdupenv_s_dbg(ps1,size,s2,t,f,l) _wdupenv_s(ps1,size,s2)..#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\io_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):881
                                                                                                                                                                                                                                            Entropy (8bit):5.049800224685949
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PD5LNUX/uOL3YnNcYDJYwKGUG7FIU9L3YqM:GUZTOL3kSiJyjoL3lM
                                                                                                                                                                                                                                            MD5:AAF6330564DC2B4B413908EF435956AF
                                                                                                                                                                                                                                            SHA1:EA59272194493914F4B0CD1375210053A34CFDC2
                                                                                                                                                                                                                                            SHA-256:6E02F4AE50D30629AF7DF34785B6C32642B12D94ADDD56606F6FC4AB668250FF
                                                                                                                                                                                                                                            SHA-512:3FD60615B2DFC257A0CACF1F985AF5AA765583DB7DE6B8E474DE52369219DA5D2276362ADD9875A820F0A424A259FE976EBFA1E18FCD7B70008AB8FF70EBA03F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_IO_S.#define _INC_IO_S..#include <io.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _access_s(const char *_Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _chsize_s(int _FileHandle,__int64 _Size);. _CRTIMP errno_t __cdecl _mktemp_s(char *_TemplateName,size_t _Size);. _CRTIMP errno_t __cdecl _umask_s(int _NewMode,int *_OldMode);..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t *_Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t *_TemplateName,size_t _SizeInWords);.#endif..#ifdef __cplusplus.}.#endif..#endif.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-43AJ9.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7492
                                                                                                                                                                                                                                            Entropy (8bit):5.001674571619953
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:2s3ligWmjN2JcabAOrco1/x+pxJrx8NxDhW21TUSBL/jCh3HzTxpppJptakhplFY:lUEU0zwyx3fnjhTtj7P9AJbfYFa
                                                                                                                                                                                                                                            MD5:37C52897CBB44A15BD22203CF8882566
                                                                                                                                                                                                                                            SHA1:27A8F810ADB10BCFD84DB971163C98ED81C3BDF9
                                                                                                                                                                                                                                            SHA-256:5A470AC358B2D951202182F9EC1F945331C23A8D79629AD4EDB08B7D73CFAEE4
                                                                                                                                                                                                                                            SHA-512:5217C9246A458EAB5657B219D136CEC221EF0539CB5C5D02BF9E1FE88159A758B247E2D925312636AA8BE4665B9D52641A9D3F2613256C3FF88985ED1D50CA05
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_WCHAR_S.#define _INC_WCHAR_S..#include <wchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t *_Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t *_TemplateName,size_t _SizeInWords);.#endif..#ifndef _WCONIO_S_DEFINED.#define _WCONIO_S_DEFINED. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t *_Buffer,size_t _SizeInWords,size_t *_SizeRead);. _CRTIMP int __cdecl _cwprintf_s(const wchar_t *_Format,...);. _CRTIMP int __cdecl _cwscanf_s(const wchar_t *_Format,...);. _CRTIMP int __cdecl _cwscanf_s_l(const wchar_t *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcwprintf_s(const wchar_t *_Format,va_list _ArgList);. _C

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7HMJ2.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1535
                                                                                                                                                                                                                                            Entropy (8bit):5.005173947475632
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDp5BUXLjIT0Cn0jIn0jQsY0eq0DY0PdMR0Mk3Z0ln0ln0fKY0xq0CY0u+:G4X+j41n8In8QsYbqgYKd00x+nknmKY1
                                                                                                                                                                                                                                            MD5:5BC78AA26AF6CE836F322CD5A432E368
                                                                                                                                                                                                                                            SHA1:1E99298161F0ADB4F7244EB5A067364DC5B47E91
                                                                                                                                                                                                                                            SHA-256:F7375E816739491FBAB39531C1D60A77B78FF9A162ABA17F817C773BF75F6508
                                                                                                                                                                                                                                            SHA-512:F1BFD5EF34A97E72EC474B2A2FECF4AC5FA1931E08845489623A7C699954B549FEDE1E4F93C815C0A9944A7D79601A9ED1342D47694528DAB54ADEAA5BBAB443
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _INC_CONIO_S.#define _INC_CONIO_S..#include <conio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _cgets_s(char *_Buffer,size_t _Size,size_t *_SizeRead);. _CRTIMP int __cdecl _cprintf_s(const char *_Format,...);. _CRTIMP int __cdecl _cscanf_s(const char *_Format,...);. _CRTIMP int __cdecl _cscanf_s_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s(const char *_Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_s_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s_l(const char *_Format,_locale_t _Locale,va_list _ArgList);..#ifndef _WCONIO_DEFINED_S.#define _WCONIO_DEFINED_S. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t *_Buffer,size_t _SizeInWords,

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7UOLD.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):881
                                                                                                                                                                                                                                            Entropy (8bit):5.049800224685949
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PD5LNUX/uOL3YnNcYDJYwKGUG7FIU9L3YqM:GUZTOL3kSiJyjoL3lM
                                                                                                                                                                                                                                            MD5:AAF6330564DC2B4B413908EF435956AF
                                                                                                                                                                                                                                            SHA1:EA59272194493914F4B0CD1375210053A34CFDC2
                                                                                                                                                                                                                                            SHA-256:6E02F4AE50D30629AF7DF34785B6C32642B12D94ADDD56606F6FC4AB668250FF
                                                                                                                                                                                                                                            SHA-512:3FD60615B2DFC257A0CACF1F985AF5AA765583DB7DE6B8E474DE52369219DA5D2276362ADD9875A820F0A424A259FE976EBFA1E18FCD7B70008AB8FF70EBA03F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_IO_S.#define _INC_IO_S..#include <io.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _access_s(const char *_Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _chsize_s(int _FileHandle,__int64 _Size);. _CRTIMP errno_t __cdecl _mktemp_s(char *_TemplateName,size_t _Size);. _CRTIMP errno_t __cdecl _umask_s(int _NewMode,int *_OldMode);..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t *_Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t *_TemplateName,size_t _SizeInWords);.#endif..#ifdef __cplusplus.}.#endif..#endif.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-BT11S.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2331
                                                                                                                                                                                                                                            Entropy (8bit):5.0544392912710165
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GcrXMDj5Rqf/Hj57+jJij5NiTiM7AdKCLUJXbfb7SlE6BQ5Sl625a:HrONRqf/HN7+9iNYm+AdKCLUJXbfYE6S
                                                                                                                                                                                                                                            MD5:EDC9CC4A2A0B921D3167F19D2D162F0B
                                                                                                                                                                                                                                            SHA1:424E2246A5B852CC80AC043F681A12F4ED95882B
                                                                                                                                                                                                                                            SHA-256:9AE9CB7A3164AD0093E3887B0CA09BB67498DA51BB44E9BE500B60E72A385DC0
                                                                                                                                                                                                                                            SHA-512:3C81D4917E9A47307393EA6AF3C6E945F6F6ACC1BAEFA764E500054F84BBAEDDA83B7CCDBAC3A1EC526E389EC7A095B0A6676AE09CEEA63EF1E95B5DE004B018
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIME_H__S.#define _TIME_H__S..#include <time.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _ctime32_s(char *_Buf,size_t _SizeInBytes,const __time32_t *_Time);. _CRTIMP errno_t __cdecl _gmtime32_s(struct tm *_Tm,const __time32_t *_Time);. _CRTIMP errno_t __cdecl _localtime32_s(struct tm *_Tm,const __time32_t *_Time);. _CRTIMP errno_t __cdecl _strdate_s(char *_Buf,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _strtime_s(char *_Buf ,size_t _SizeInBytes);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ctime64_s(char *_Buf,size_t _SizeInBytes,const __time64_t *_Time);. _CRTIMP errno_t __cdecl _gmtime64_s(struct tm *_Tm,const __time64_t *_Time);. _CRTIMP errno_t __cdecl _localtime64_s(struct tm *_Tm,

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-C3O5E.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8328
                                                                                                                                                                                                                                            Entropy (8bit):4.549418379824187
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:bQGkyRvKPf4e80QgHRySdrCcNNXe1FcNNFe1d6O1yv61ycNNue1ccNNYe1e1O1e3:c11WgJ17OBBapWcEqJ
                                                                                                                                                                                                                                            MD5:1C3243D5951CCF4C4007E89FD366631D
                                                                                                                                                                                                                                            SHA1:48FE81CEA21230097C39FFC92C9B5BCAB3B4D0B1
                                                                                                                                                                                                                                            SHA-256:A5318CCEB241962769169C32A3CE5BFB9A075A52EDBAC31AAD33B0D7B897B544
                                                                                                                                                                                                                                            SHA-512:F6D25B5532745933F4320280AC21DD02CD12872639333B3AD04F4EFBBB42CFE51F5AD828F6CB2134968F5503979029AC38AD208572AD3FD298BDCC97677ECEDD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_TCHAR_S.#define _INC_TCHAR_S..#include <tchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _UNICODE..#define _tprintf_s wprintf_s.#define _tprintf_s_l _wprintf_s_l.#define _tcprintf_s _cwprintf_s.#define _tcprintf_s_l _cwprintf_s_l.#define _vtcprintf_s _vcwprintf_s.#define _vtcprintf_s_l _vcwprintf_s_l.#define _ftprintf_s fwprintf_s.#define _ftprintf_s_l _fwprintf_s_l.#define _stprintf_s swprintf_s.#define _stprintf_s_l _swprintf_s_l.#define _sntprintf_s _snwprintf_s.#define _sntprintf_s_l _snwprintf_s_l.#define _vtprintf_s vwprintf_s.#define _vtprintf_s_l _vwprintf_s_l.#define _vftprintf_s vfwprintf_s.#define _vftprintf_s_l _vfwprintf_s_l.#define _vstprintf_s vswprintf_s.#define _vstprintf_s_l _vswprintf_s_l.#define _vsntp

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-EI6G4.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11508
                                                                                                                                                                                                                                            Entropy (8bit):4.850439541273333
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:nzXsE4vla8LmEtTcbA4MfaEU0zwyp0WEP9fF2V:8
                                                                                                                                                                                                                                            MD5:3C28755C2186DABAE016938E1308B77F
                                                                                                                                                                                                                                            SHA1:9437B43CD64ED70638DF695B1B9EAB34C1B04F57
                                                                                                                                                                                                                                            SHA-256:5107BED740C6274FFC767AD42DED6CE5A8F51CB0C73239D04D5A647D62EDF2F1
                                                                                                                                                                                                                                            SHA-512:9D89FE5E5B8396998A552E443970F45C8E9F2F04F180D14F1CBBDC56A1FD5AE0F2C9F81B8E25D0DCB20FB1437D9BD178A6DAD68A323AA0E9EAEF31B6B6D40F33
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDIO_S.#define _INC_STDIO_S..#include <stdio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _STDIO_S_DEFINED.#define _STDIO_S_DEFINED. _CRTIMP errno_t __cdecl clearerr_s(FILE *_File);. int __cdecl fprintf_s(FILE *_File,const char *_Format,...);. size_t __cdecl fread_s(void *_DstBuf,size_t _DstSize,size_t _ElementSize,size_t _Count,FILE *_File);. _CRTIMP int __cdecl _fscanf_s_l(FILE *_File,const char *_Format,_locale_t _Locale,...);. int __cdecl printf_s(const char *_Format,...);. _CRTIMP int __cdecl _scanf_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _scanf_s_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _snprintf_s(char *_DstBuf,size_t _DstSize,size_t _MaxCount,const char

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-FDRG6.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):824
                                                                                                                                                                                                                                            Entropy (8bit):5.23907989533424
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDbldUsxgi7ZmA10jrL8sxqpCTkTAfEjd2FL0:GENuiZmU0jrIhT9jdKA
                                                                                                                                                                                                                                            MD5:C46DB571CFDB29EA8F977222B4BDA152
                                                                                                                                                                                                                                            SHA1:727F853FE74015580AE152B7DA8E1958B19FE22B
                                                                                                                                                                                                                                            SHA-256:B23F0CF79D5455E232D92792E2B2BE38125A02808BC005049367BAB68DA1300B
                                                                                                                                                                                                                                            SHA-512:747FEFA9B6DC0B5B1DE13ACFFBECCDBD7542A1241DEE3299F584FD08D65EAE8D1814305C44FC5AD580D865CF73AE9A8072F5AD7FD5E8439DE034EE82FD789CA7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef __STRALIGN_H_S_.#define __STRALIGN_H_S_..#include <stralign.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#if !defined(I_X86_) && defined(_WSTRING_S_DEFINED).#if defined(__cplusplus) && defined(_WConst_Return). static __inline PUWSTR ua_wcscpy_s(PUWSTR Destination,size_t DestinationSize,PCUWSTR Source) {. if(WSTR_ALIGNED(Source) && WSTR_ALIGNED(Destination)) return (wcscpy_s((PWSTR)Destination,DestinationSize,(PCWSTR)Source)==0 ? Destination : NULL);. return uaw_wcscpy((PCUWSTR)String,Character);. }.#endif.#endif..#ifdef __cplusplus.}.#endif.#endif.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-G03C8.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4113
                                                                                                                                                                                                                                            Entropy (8bit):5.025747893872523
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:1ICzd9hzhSzms1NOsG1/zl1EzQm2pppJptakhplumHNNmeN4mfNaAqk58ikTNBkm:tp9hFS6s1gsiB3fnjhTVS24Y4LN
                                                                                                                                                                                                                                            MD5:AE13BD6218C4840EACAC71F31C45B2BC
                                                                                                                                                                                                                                            SHA1:E05D796CE8F5AEAA629CA9F1E3F6D4AC154148A2
                                                                                                                                                                                                                                            SHA-256:8650E34BE241C7D837433126878EB6A30EE71C0B759C23671FD8F0715C7CDE65
                                                                                                                                                                                                                                            SHA-512:689808A64C20260F3091E94DCE6EAABF8662BA627B4DE4C43ED685390565186E69FF229CB4755E9D3BD12B5C46E16CCFD848652703572E790DF7BBAB3824FF9A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDLIB_S.#define _INC_STDLIB_S..#include <stdlib.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _dupenv_s(char **_PBuffer,size_t *_PBufferSizeInBytes,const char *_VarName);. _CRTIMP errno_t __cdecl _itoa_s(int _Value,char *_DstBuf,size_t _Size,int _Radix);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _i64toa_s(__int64 _Val,char *_DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl _ui64toa_s(unsigned __int64 _Val,char *_DstBuf,size_t _Size,int _Radix);.#endif. _CRTIMP errno_t __cdecl _ltoa_s(long _Val,char *_DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl mbstowcs_s(size_t *_PtNumOfCharConverted,wchar_t *_DstBuf,size_t _SizeInWords,const char *_SrcBuf,size_t _MaxCount);. _CRTI

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-MR0MU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):796
                                                                                                                                                                                                                                            Entropy (8bit):5.075906205009732
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BUksYTAKG2U1OAb9vw4DRWJKRWFoY2j9vw4DRWJKRW5:i2PSh0PDxjdUpbpw4NWIWFepw4NWIW5
                                                                                                                                                                                                                                            MD5:E0C3256D4BE1AD2A506755EB847C2D39
                                                                                                                                                                                                                                            SHA1:236108EEED6AFC8156950DAE94A055B90F8D169E
                                                                                                                                                                                                                                            SHA-256:96174E09F1C573C7FAEA85A6D568225A1B946E133C6C04A7BD6AA865C58896A2
                                                                                                                                                                                                                                            SHA-512:501E4C147ABA8CC08D3195BBA9328D3ED6186E8BFE60EF4DE65F09441F708ABDAAC9D7ED4C84CCD4CE21075F45D0C8B60B2BF8A927AD8A449C11EF6B2711032A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SEARCH_S.#define _INC_SEARCH_S..#include <search.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP void *__cdecl _lfind_s(const void *_Key,const void *_Base,unsigned int *_NumOfElements,size_t _SizeOfElements,int (__cdecl *_PtFuncCompare)(void *,const void *,const void *),void *_Context);. _CRTIMP void *__cdecl _lsearch_s(const void *_Key,void *_Base,unsigned int *_NumOfElements,size_t _SizeOfElements,int (__cdecl *_PtFuncCompare)(void *,const void *,const void *),void *_Context);..#ifdef __cplusplus.}.#endif..#endif.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-OR2O6.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1787
                                                                                                                                                                                                                                            Entropy (8bit):4.917564903414643
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GdhfZfj5LsD61nVtwNwDmwMRTNU5bTTwNTrbTy7TZe1TGdTt8u:QZZfNLsD61V+NwDmw0hUZgNnbu71e1a9
                                                                                                                                                                                                                                            MD5:544899F39CA616AE07D97A2FEE8DE3D4
                                                                                                                                                                                                                                            SHA1:2F95831D27CC918E633E8D711087CCF7C3DA918B
                                                                                                                                                                                                                                            SHA-256:EEF32FB505B98A3610923E8DDB3DE724C55B44389D25CEF7CF50EE3CD14F5D68
                                                                                                                                                                                                                                            SHA-512:20DBF6C25FF2270402BB4EB99430B83128F66D577B7C9277CACBF8CDB5438EC58B6B1EA468499D1F48338CF4F2433A1A0E59E242F812B419C6AFC637340C86AB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STRING_S.#define _INC_STRING_S..#include <string.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _strset_s(char *_Dst,size_t _DstSize,int _Value);. _CRTIMP errno_t __cdecl _strerror_s(char *_Buf,size_t _SizeInBytes,const char *_ErrMsg);. _CRTIMP errno_t __cdecl _strlwr_s(char *_Str,size_t _Size);. _CRTIMP errno_t __cdecl _strlwr_s_l(char *_Str,size_t _Size,_locale_t _Locale);. _CRTIMP errno_t __cdecl _strnset_s(char *_Str,size_t _Size,int _Val,size_t _MaxCount);. _CRTIMP errno_t __cdecl _strupr_s(char *_Str,size_t _Size);. _CRTIMP errno_t __cdecl _strupr_s_l(char *_Str,size_t _Size,_locale_t _Locale);.#ifndef _WSTRING_S_DEFINED.#define _WSTRING_S_DEFINED. _CRTIMP wchar_t *__cdecl wcstok_s(wchar_t *_St

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-Q48TO.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):461
                                                                                                                                                                                                                                            Entropy (8bit):5.161018019410615
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BtsYzlAEG2UCqAhEGksdAwED:i2PSh0PDtJLUtNjOqD
                                                                                                                                                                                                                                            MD5:F0C359A5AA08A907A23D2C0C5AA68E5C
                                                                                                                                                                                                                                            SHA1:B487788EC6AA32458DF18F6D10F67573DE8FA16E
                                                                                                                                                                                                                                            SHA-256:03630EE83E7C921446A0790853FCADEB5A308553DD3C4ECDDD568CDA3167C0F1
                                                                                                                                                                                                                                            SHA-512:71BD41E6BD84BFFE34BEB8EF1B49C63358CB5D8E520972D57046D58E9D9FB6DEAE512E4CF5554337DA2510D6F3AFCD6C6D58124A30C4003F9E3A8F60C2FFA896
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _INC_CRTDBG_S.#define _INC_CRTDBG_S..#include <crtdbg.h>..#if defined(MINGW_HAS_SECURE_API)..#define _dupenv_s_dbg(ps1,size,s2,t,f,l) _dupenv_s(ps1,size,s2).#define _wdupenv_s_dbg(ps1,size,s2,t,f,l) _wdupenv_s(ps1,size,s2)..#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\is-S1JMU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3615
                                                                                                                                                                                                                                            Entropy (8bit):4.86966174138245
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:fo/15F1iM17NNse1NNNie16Nw11NNKe1/NNQe1uNO1Yk1gQ1Cs1s2s+w:wdi69Ah
                                                                                                                                                                                                                                            MD5:EDEDEEC78FA33C84025495013A88BF1A
                                                                                                                                                                                                                                            SHA1:7CB95B9B6DF8927222625EA101A72389B8A5318F
                                                                                                                                                                                                                                            SHA-256:D962AB8070958953F48B24C9EA068B345B158237826FB71B9A76D36CF2E8A32B
                                                                                                                                                                                                                                            SHA-512:B32E7891109560B4DF8BBBD1B3BB6D2ACEC9158C35743EB97A88F3B1237114979057B00ACD2CBB594CB1DB555E5AF5DDCAA610FE13C141A20494CA47319F65B0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_MBSTRING_S.#define _INC_MBSTRING_S..#include <mbstring.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _MBSTRING_S_DEFINED.#define _MBSTRING_S_DEFINED. _CRTIMP errno_t __cdecl _mbscat_s(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src);. _CRTIMP errno_t __cdecl _mbscat_s_l(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbscpy_s(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src);. _CRTIMP errno_t __cdecl _mbscpy_s_l(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbslwr_s(unsigned char *_Str,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _mbslwr_s_l(

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\mbstring_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3615
                                                                                                                                                                                                                                            Entropy (8bit):4.86966174138245
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:fo/15F1iM17NNse1NNNie16Nw11NNKe1/NNQe1uNO1Yk1gQ1Cs1s2s+w:wdi69Ah
                                                                                                                                                                                                                                            MD5:EDEDEEC78FA33C84025495013A88BF1A
                                                                                                                                                                                                                                            SHA1:7CB95B9B6DF8927222625EA101A72389B8A5318F
                                                                                                                                                                                                                                            SHA-256:D962AB8070958953F48B24C9EA068B345B158237826FB71B9A76D36CF2E8A32B
                                                                                                                                                                                                                                            SHA-512:B32E7891109560B4DF8BBBD1B3BB6D2ACEC9158C35743EB97A88F3B1237114979057B00ACD2CBB594CB1DB555E5AF5DDCAA610FE13C141A20494CA47319F65B0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_MBSTRING_S.#define _INC_MBSTRING_S..#include <mbstring.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _MBSTRING_S_DEFINED.#define _MBSTRING_S_DEFINED. _CRTIMP errno_t __cdecl _mbscat_s(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src);. _CRTIMP errno_t __cdecl _mbscat_s_l(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbscpy_s(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src);. _CRTIMP errno_t __cdecl _mbscpy_s_l(unsigned char *_Dst,size_t _DstSizeInBytes,const unsigned char *_Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbslwr_s(unsigned char *_Str,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _mbslwr_s_l(

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\search_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):796
                                                                                                                                                                                                                                            Entropy (8bit):5.075906205009732
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BUksYTAKG2U1OAb9vw4DRWJKRWFoY2j9vw4DRWJKRW5:i2PSh0PDxjdUpbpw4NWIWFepw4NWIW5
                                                                                                                                                                                                                                            MD5:E0C3256D4BE1AD2A506755EB847C2D39
                                                                                                                                                                                                                                            SHA1:236108EEED6AFC8156950DAE94A055B90F8D169E
                                                                                                                                                                                                                                            SHA-256:96174E09F1C573C7FAEA85A6D568225A1B946E133C6C04A7BD6AA865C58896A2
                                                                                                                                                                                                                                            SHA-512:501E4C147ABA8CC08D3195BBA9328D3ED6186E8BFE60EF4DE65F09441F708ABDAAC9D7ED4C84CCD4CE21075F45D0C8B60B2BF8A927AD8A449C11EF6B2711032A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SEARCH_S.#define _INC_SEARCH_S..#include <search.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP void *__cdecl _lfind_s(const void *_Key,const void *_Base,unsigned int *_NumOfElements,size_t _SizeOfElements,int (__cdecl *_PtFuncCompare)(void *,const void *,const void *),void *_Context);. _CRTIMP void *__cdecl _lsearch_s(const void *_Key,void *_Base,unsigned int *_NumOfElements,size_t _SizeOfElements,int (__cdecl *_PtFuncCompare)(void *,const void *,const void *),void *_Context);..#ifdef __cplusplus.}.#endif..#endif.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\stdio_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11508
                                                                                                                                                                                                                                            Entropy (8bit):4.850439541273333
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:nzXsE4vla8LmEtTcbA4MfaEU0zwyp0WEP9fF2V:8
                                                                                                                                                                                                                                            MD5:3C28755C2186DABAE016938E1308B77F
                                                                                                                                                                                                                                            SHA1:9437B43CD64ED70638DF695B1B9EAB34C1B04F57
                                                                                                                                                                                                                                            SHA-256:5107BED740C6274FFC767AD42DED6CE5A8F51CB0C73239D04D5A647D62EDF2F1
                                                                                                                                                                                                                                            SHA-512:9D89FE5E5B8396998A552E443970F45C8E9F2F04F180D14F1CBBDC56A1FD5AE0F2C9F81B8E25D0DCB20FB1437D9BD178A6DAD68A323AA0E9EAEF31B6B6D40F33
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDIO_S.#define _INC_STDIO_S..#include <stdio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _STDIO_S_DEFINED.#define _STDIO_S_DEFINED. _CRTIMP errno_t __cdecl clearerr_s(FILE *_File);. int __cdecl fprintf_s(FILE *_File,const char *_Format,...);. size_t __cdecl fread_s(void *_DstBuf,size_t _DstSize,size_t _ElementSize,size_t _Count,FILE *_File);. _CRTIMP int __cdecl _fscanf_s_l(FILE *_File,const char *_Format,_locale_t _Locale,...);. int __cdecl printf_s(const char *_Format,...);. _CRTIMP int __cdecl _scanf_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _scanf_s_l(const char *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _snprintf_s(char *_DstBuf,size_t _DstSize,size_t _MaxCount,const char

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\stdlib_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4113
                                                                                                                                                                                                                                            Entropy (8bit):5.025747893872523
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:1ICzd9hzhSzms1NOsG1/zl1EzQm2pppJptakhplumHNNmeN4mfNaAqk58ikTNBkm:tp9hFS6s1gsiB3fnjhTVS24Y4LN
                                                                                                                                                                                                                                            MD5:AE13BD6218C4840EACAC71F31C45B2BC
                                                                                                                                                                                                                                            SHA1:E05D796CE8F5AEAA629CA9F1E3F6D4AC154148A2
                                                                                                                                                                                                                                            SHA-256:8650E34BE241C7D837433126878EB6A30EE71C0B759C23671FD8F0715C7CDE65
                                                                                                                                                                                                                                            SHA-512:689808A64C20260F3091E94DCE6EAABF8662BA627B4DE4C43ED685390565186E69FF229CB4755E9D3BD12B5C46E16CCFD848652703572E790DF7BBAB3824FF9A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDLIB_S.#define _INC_STDLIB_S..#include <stdlib.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _dupenv_s(char **_PBuffer,size_t *_PBufferSizeInBytes,const char *_VarName);. _CRTIMP errno_t __cdecl _itoa_s(int _Value,char *_DstBuf,size_t _Size,int _Radix);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _i64toa_s(__int64 _Val,char *_DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl _ui64toa_s(unsigned __int64 _Val,char *_DstBuf,size_t _Size,int _Radix);.#endif. _CRTIMP errno_t __cdecl _ltoa_s(long _Val,char *_DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl mbstowcs_s(size_t *_PtNumOfCharConverted,wchar_t *_DstBuf,size_t _SizeInWords,const char *_SrcBuf,size_t _MaxCount);. _CRTI

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\stralign_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):824
                                                                                                                                                                                                                                            Entropy (8bit):5.23907989533424
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDbldUsxgi7ZmA10jrL8sxqpCTkTAfEjd2FL0:GENuiZmU0jrIhT9jdKA
                                                                                                                                                                                                                                            MD5:C46DB571CFDB29EA8F977222B4BDA152
                                                                                                                                                                                                                                            SHA1:727F853FE74015580AE152B7DA8E1958B19FE22B
                                                                                                                                                                                                                                            SHA-256:B23F0CF79D5455E232D92792E2B2BE38125A02808BC005049367BAB68DA1300B
                                                                                                                                                                                                                                            SHA-512:747FEFA9B6DC0B5B1DE13ACFFBECCDBD7542A1241DEE3299F584FD08D65EAE8D1814305C44FC5AD580D865CF73AE9A8072F5AD7FD5E8439DE034EE82FD789CA7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef __STRALIGN_H_S_.#define __STRALIGN_H_S_..#include <stralign.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#if !defined(I_X86_) && defined(_WSTRING_S_DEFINED).#if defined(__cplusplus) && defined(_WConst_Return). static __inline PUWSTR ua_wcscpy_s(PUWSTR Destination,size_t DestinationSize,PCUWSTR Source) {. if(WSTR_ALIGNED(Source) && WSTR_ALIGNED(Destination)) return (wcscpy_s((PWSTR)Destination,DestinationSize,(PCWSTR)Source)==0 ? Destination : NULL);. return uaw_wcscpy((PCUWSTR)String,Character);. }.#endif.#endif..#ifdef __cplusplus.}.#endif.#endif.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\string_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1787
                                                                                                                                                                                                                                            Entropy (8bit):4.917564903414643
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GdhfZfj5LsD61nVtwNwDmwMRTNU5bTTwNTrbTy7TZe1TGdTt8u:QZZfNLsD61V+NwDmw0hUZgNnbu71e1a9
                                                                                                                                                                                                                                            MD5:544899F39CA616AE07D97A2FEE8DE3D4
                                                                                                                                                                                                                                            SHA1:2F95831D27CC918E633E8D711087CCF7C3DA918B
                                                                                                                                                                                                                                            SHA-256:EEF32FB505B98A3610923E8DDB3DE724C55B44389D25CEF7CF50EE3CD14F5D68
                                                                                                                                                                                                                                            SHA-512:20DBF6C25FF2270402BB4EB99430B83128F66D577B7C9277CACBF8CDB5438EC58B6B1EA468499D1F48338CF4F2433A1A0E59E242F812B419C6AFC637340C86AB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STRING_S.#define _INC_STRING_S..#include <string.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _strset_s(char *_Dst,size_t _DstSize,int _Value);. _CRTIMP errno_t __cdecl _strerror_s(char *_Buf,size_t _SizeInBytes,const char *_ErrMsg);. _CRTIMP errno_t __cdecl _strlwr_s(char *_Str,size_t _Size);. _CRTIMP errno_t __cdecl _strlwr_s_l(char *_Str,size_t _Size,_locale_t _Locale);. _CRTIMP errno_t __cdecl _strnset_s(char *_Str,size_t _Size,int _Val,size_t _MaxCount);. _CRTIMP errno_t __cdecl _strupr_s(char *_Str,size_t _Size);. _CRTIMP errno_t __cdecl _strupr_s_l(char *_Str,size_t _Size,_locale_t _Locale);.#ifndef _WSTRING_S_DEFINED.#define _WSTRING_S_DEFINED. _CRTIMP wchar_t *__cdecl wcstok_s(wchar_t *_St

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\is-FLJQJ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):653
                                                                                                                                                                                                                                            Entropy (8bit):5.082827078744625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BjksvAEfG2U17NrOmRyOmRpILKuhQziQFgu7voLKuhNzia:i2PSh0PDjkcTUhNCQR8RAj
                                                                                                                                                                                                                                            MD5:001FD701688E91D3781D43714B993275
                                                                                                                                                                                                                                            SHA1:A1825995271FE96DC766421CEDC606384CD92201
                                                                                                                                                                                                                                            SHA-256:D153417EC64EB7B1504749BCA6477EFD51B4B22DE670518F4FDC2701080145C0
                                                                                                                                                                                                                                            SHA-512:F4F4A8D796E74CB0AD2A06DD153EBAF4CD16C431FDC67B7C2FBBDC4466147593421AE0F60A620503B21DC3C05C6480CA483BD077AFB10DACA46529996B4391B6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _TIMEB_H_S.#define _TIMEB_H_S..#include <sys/timeb.h>..#ifdef __cplusplus.extern "C" {.#endif..#if defined(MINGW_HAS_SECURE_API)..#ifdef _USE_32BIT_TIME_T.#define _ftime_s _ftime32_s.#else.#define _ftime_s _ftime64_s.#endif.. _CRTIMP errno_t __cdecl _ftime32_s(struct __timeb32 *_Time);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ftime64_s(struct __timeb64 *_Time);.#endif.#endif..#ifdef __cplusplus.}.#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\timeb_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):653
                                                                                                                                                                                                                                            Entropy (8bit):5.082827078744625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BjksvAEfG2U17NrOmRyOmRpILKuhQziQFgu7voLKuhNzia:i2PSh0PDjkcTUhNCQR8RAj
                                                                                                                                                                                                                                            MD5:001FD701688E91D3781D43714B993275
                                                                                                                                                                                                                                            SHA1:A1825995271FE96DC766421CEDC606384CD92201
                                                                                                                                                                                                                                            SHA-256:D153417EC64EB7B1504749BCA6477EFD51B4B22DE670518F4FDC2701080145C0
                                                                                                                                                                                                                                            SHA-512:F4F4A8D796E74CB0AD2A06DD153EBAF4CD16C431FDC67B7C2FBBDC4466147593421AE0F60A620503B21DC3C05C6480CA483BD077AFB10DACA46529996B4391B6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _TIMEB_H_S.#define _TIMEB_H_S..#include <sys/timeb.h>..#ifdef __cplusplus.extern "C" {.#endif..#if defined(MINGW_HAS_SECURE_API)..#ifdef _USE_32BIT_TIME_T.#define _ftime_s _ftime32_s.#else.#define _ftime_s _ftime64_s.#endif.. _CRTIMP errno_t __cdecl _ftime32_s(struct __timeb32 *_Time);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ftime64_s(struct __timeb64 *_Time);.#endif.#endif..#ifdef __cplusplus.}.#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\tchar_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8328
                                                                                                                                                                                                                                            Entropy (8bit):4.549418379824187
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:bQGkyRvKPf4e80QgHRySdrCcNNXe1FcNNFe1d6O1yv61ycNNue1ccNNYe1e1O1e3:c11WgJ17OBBapWcEqJ
                                                                                                                                                                                                                                            MD5:1C3243D5951CCF4C4007E89FD366631D
                                                                                                                                                                                                                                            SHA1:48FE81CEA21230097C39FFC92C9B5BCAB3B4D0B1
                                                                                                                                                                                                                                            SHA-256:A5318CCEB241962769169C32A3CE5BFB9A075A52EDBAC31AAD33B0D7B897B544
                                                                                                                                                                                                                                            SHA-512:F6D25B5532745933F4320280AC21DD02CD12872639333B3AD04F4EFBBB42CFE51F5AD828F6CB2134968F5503979029AC38AD208572AD3FD298BDCC97677ECEDD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_TCHAR_S.#define _INC_TCHAR_S..#include <tchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _UNICODE..#define _tprintf_s wprintf_s.#define _tprintf_s_l _wprintf_s_l.#define _tcprintf_s _cwprintf_s.#define _tcprintf_s_l _cwprintf_s_l.#define _vtcprintf_s _vcwprintf_s.#define _vtcprintf_s_l _vcwprintf_s_l.#define _ftprintf_s fwprintf_s.#define _ftprintf_s_l _fwprintf_s_l.#define _stprintf_s swprintf_s.#define _stprintf_s_l _swprintf_s_l.#define _sntprintf_s _snwprintf_s.#define _sntprintf_s_l _snwprintf_s_l.#define _vtprintf_s vwprintf_s.#define _vtprintf_s_l _vwprintf_s_l.#define _vftprintf_s vfwprintf_s.#define _vftprintf_s_l _vfwprintf_s_l.#define _vstprintf_s vswprintf_s.#define _vstprintf_s_l _vswprintf_s_l.#define _vsntp

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\time_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2331
                                                                                                                                                                                                                                            Entropy (8bit):5.0544392912710165
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GcrXMDj5Rqf/Hj57+jJij5NiTiM7AdKCLUJXbfb7SlE6BQ5Sl625a:HrONRqf/HN7+9iNYm+AdKCLUJXbfYE6S
                                                                                                                                                                                                                                            MD5:EDC9CC4A2A0B921D3167F19D2D162F0B
                                                                                                                                                                                                                                            SHA1:424E2246A5B852CC80AC043F681A12F4ED95882B
                                                                                                                                                                                                                                            SHA-256:9AE9CB7A3164AD0093E3887B0CA09BB67498DA51BB44E9BE500B60E72A385DC0
                                                                                                                                                                                                                                            SHA-512:3C81D4917E9A47307393EA6AF3C6E945F6F6ACC1BAEFA764E500054F84BBAEDDA83B7CCDBAC3A1EC526E389EC7A095B0A6676AE09CEEA63EF1E95B5DE004B018
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIME_H__S.#define _TIME_H__S..#include <time.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _ctime32_s(char *_Buf,size_t _SizeInBytes,const __time32_t *_Time);. _CRTIMP errno_t __cdecl _gmtime32_s(struct tm *_Tm,const __time32_t *_Time);. _CRTIMP errno_t __cdecl _localtime32_s(struct tm *_Tm,const __time32_t *_Time);. _CRTIMP errno_t __cdecl _strdate_s(char *_Buf,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _strtime_s(char *_Buf ,size_t _SizeInBytes);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ctime64_s(char *_Buf,size_t _SizeInBytes,const __time64_t *_Time);. _CRTIMP errno_t __cdecl _gmtime64_s(struct tm *_Tm,const __time64_t *_Time);. _CRTIMP errno_t __cdecl _localtime64_s(struct tm *_Tm,

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sec_api\wchar_s.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):7492
                                                                                                                                                                                                                                            Entropy (8bit):5.001674571619953
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:2s3ligWmjN2JcabAOrco1/x+pxJrx8NxDhW21TUSBL/jCh3HzTxpppJptakhplFY:lUEU0zwyx3fnjhTtj7P9AJbfYFa
                                                                                                                                                                                                                                            MD5:37C52897CBB44A15BD22203CF8882566
                                                                                                                                                                                                                                            SHA1:27A8F810ADB10BCFD84DB971163C98ED81C3BDF9
                                                                                                                                                                                                                                            SHA-256:5A470AC358B2D951202182F9EC1F945331C23A8D79629AD4EDB08B7D73CFAEE4
                                                                                                                                                                                                                                            SHA-512:5217C9246A458EAB5657B219D136CEC221EF0539CB5C5D02BF9E1FE88159A758B247E2D925312636AA8BE4665B9D52641A9D3F2613256C3FF88985ED1D50CA05
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_WCHAR_S.#define _INC_WCHAR_S..#include <wchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t *_Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t *_TemplateName,size_t _SizeInWords);.#endif..#ifndef _WCONIO_S_DEFINED.#define _WCONIO_S_DEFINED. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t *_Buffer,size_t _SizeInWords,size_t *_SizeRead);. _CRTIMP int __cdecl _cwprintf_s(const wchar_t *_Format,...);. _CRTIMP int __cdecl _cwscanf_s(const wchar_t *_Format,...);. _CRTIMP int __cdecl _cwscanf_s_l(const wchar_t *_Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcwprintf_s(const wchar_t *_Format,va_list _ArgList);. _C

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\setjmp.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3867
                                                                                                                                                                                                                                            Entropy (8bit):5.235190435579294
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:hINzkdpqiPK62I7m503BDSX92h1Mjw9dQZOpxrW7qcvshO+RgA2CRu/PXOE:hINzkdpqiPKdI7m503FSXUhOjw9Fpxrs
                                                                                                                                                                                                                                            MD5:8BF97DC43B347CBCF622768EF43090EF
                                                                                                                                                                                                                                            SHA1:E6BE2C1B1FE50C19BCD2814E3827C7D94680E51B
                                                                                                                                                                                                                                            SHA-256:B6164EB7FAE4A12163251492F7F4E56CC50D146EC7A2F5640D86ECA4D095046F
                                                                                                                                                                                                                                            SHA-512:F2F1A16A1D719B10A20B8BE8B5046E151C50792D8D07A2E7F6BC8EB0D53FFCE7E66E53934E688FD1C3FDFE00545BF203267FB59CBD289AD92F3786E473F8198F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SETJMP.#define _INC_SETJMP..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#if (defined(_X86_) && !defined(__x86_64))..#define _JBLEN 16.#define _JBTYPE int.. typedef struct __JUMP_BUFFER {. unsigned long Ebp;. unsigned long Ebx;. unsigned long Edi;. unsigned long Esi;. unsigned long Esp;. unsigned long Eip;. unsigned long Registration;. unsigned long TryLevel;. unsigned long Cookie;. unsigned long UnwindFunc;. unsigned long UnwindData[6];. } _JUMP_BUFFER;.#elif defined(__ia64__). typedef _CRT_ALIGN(16) struct _SETJMP_FLOAT128 {. __int64 LowPart;. __int64 HighPart;. } SETJMP_FLOAT128;..#define _JBLEN 33. typedef SETJMP_FLOAT128 _JBTYPE;.. typedef struct __JUMP_BUFFER {..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\share.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):639
                                                                                                                                                                                                                                            Entropy (8bit):5.116570644892466
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BWIYKIiSUfwfvarry9rowrrqir3qGr+PFeHqveB7n4y8yvkA4p:i2PSh0PDWWIivavaq98whzlgFeHqve7u
                                                                                                                                                                                                                                            MD5:540EF403878DDBE2D4682540DA20095F
                                                                                                                                                                                                                                            SHA1:4E3230DF4B7A906CDC3B6E3E1A5CC768CC79C327
                                                                                                                                                                                                                                            SHA-256:6DE922C1BD7EEDC33308304785C212945064D763EEDFB373C09CBBB5CB933DDE
                                                                                                                                                                                                                                            SHA-512:7C27842CB6F3D2B9707A5DF55B45BCC5DD613CDA8C550F0232F0CB9DF8B59013F428EC3FC07FB002DFF80D26BB9941CE76CAADD22BD4B539C9F11EA13FE12EF5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SHARE.#define _INC_SHARE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#define _SH_COMPAT 0x00.#define _SH_DENYRW 0x10.#define _SH_DENYWR 0x20.#define _SH_DENYRD 0x30.#define _SH_DENYNO 0x40.#define _SH_SECURE 0x80..#ifndef.NO_OLDNAMES.#define SH_COMPAT _SH_COMPAT.#define SH_DENYRW _SH_DENYRW.#define SH_DENYWR _SH_DENYWR.#define SH_DENYRD _SH_DENYRD.#define SH_DENYNO _SH_DENYNO.#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\signal.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1583
                                                                                                                                                                                                                                            Entropy (8bit):5.223946000134317
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:i2PSh0PDPvH5BolYl9cEPXEDv5JOhS3zDOE/MVuTYE3tmV+Rv4fMBzN80FnPibwB:GWcqvvsDNzD9koS+94fQzN8OPibwDrhT
                                                                                                                                                                                                                                            MD5:A106C85866BF88A68510029349149B52
                                                                                                                                                                                                                                            SHA1:989F8BF922CAC5BEB03905A0E35C3C7B4B125C85
                                                                                                                                                                                                                                            SHA-256:045A031B376733ED7A685BC01709F5281403729FF7C601B913B2ACA2FE1493BB
                                                                                                                                                                                                                                            SHA-512:205611A36897D5A87EB54DA5C2C193680DAD95DDA01A55DCEF61665ED09EFD322A20F276D9419A64144941CF0B59339FF9D15C1A7A9C86DA60F140364EACFF73
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SIGNAL.#define _INC_SIGNAL..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _SIG_ATOMIC_T_DEFINED.#define _SIG_ATOMIC_T_DEFINED. typedef int sig_atomic_t;.#endif..#define NSIG 23..#define.SIGHUP.1./* hangup */.#define SIGINT 2.#define.SIGQUIT.3./* quit */.#define SIGILL 4.#define.SIGTRAP.5./* trace trap (not reset when caught) */.#define.SIGIOT.6./* IOT instruction */.#define.SIGABRT 6./* used by abort, replace SIGIOT in the future */.#define.SIGEMT.7./* EMT instruction */.#define SIGFPE 8.#define.SIGKILL.9./* kill (cannot be caught or ignored) */.#define.SIGBUS.10./* bus error */.#define SIGSEGV 11.#define.SIGSYS.12./* bad argument to system call */.#define.SIGPIPE.13./* write on a pipe with no one to read it */.#ifdef __USE_MINGW_ALARM.#def

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\stdarg.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2494
                                                                                                                                                                                                                                            Entropy (8bit):4.862990168468474
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:QAs3d3qmP8lV0TTPWuj/ATVhpIOFf6yrsEgTvVOFobil:QAGdafP0P/IiA
                                                                                                                                                                                                                                            MD5:4FE6BA37DEC896AB822646118B5343CE
                                                                                                                                                                                                                                            SHA1:EA68660748139159643AB495AA1EC9287A5E20FF
                                                                                                                                                                                                                                            SHA-256:116504A7C3FEABBC4551E9DB0BEC957170647EF2067EB46A4304BCBFDDCE5A30
                                                                                                                                                                                                                                            SHA-512:6B3304630293A2A5C1D4870B088A7FA2681354A4D28D6DFD97CDA16E102D6E97A19CB5C9A840C8587479E4A559AB3EE781F1E9001F1336C9318988B1F2F22CC7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _STDARG_H.#define _STDARG_H..#ifdef __x86_64__.#ifndef _WIN64..//This should be in sync with the declaration on our lib/libtcc1.c./* GCC compatible definition of va_list. */.typedef struct {. unsigned int gp_offset;. unsigned int fp_offset;. union {. unsigned int overflow_offset;. char *overflow_arg_area;. };. char *reg_save_area;.} __va_list_struct;..typedef __va_list_struct va_list[1];..void __va_start(__va_list_struct *ap, void *fp);.void *__va_arg(__va_list_struct *ap, int arg_type, int size, int align);..#define va_start(ap, last) __va_start(ap, __builtin_frame_address(0)).#define va_arg(ap, type) \. (*(type *)(__va_arg(ap, __builtin_va_arg_types(type), sizeof(type), __alignof__(type)))).#define va_copy(dest, src) (*(dest) = *(src)).#define va_end(ap)../* avoid conflicting definition for va_list on Macs. */.#define _VA_LIST_T..#else /* _WIN64 */.typedef char *va_list;.#define va_start(ap,last) _

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\stdbool.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):176
                                                                                                                                                                                                                                            Entropy (8bit):4.607652660491414
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:YDC60AhCWNRSh4Hf9OKhW70rAcM05eB70AUrEtvQ7DM0zU2kx4Cv:mp0AnRoCkKu0McM0sF0AUn7f4Tv
                                                                                                                                                                                                                                            MD5:7D294F4EC2C9640974803A61153EF3DD
                                                                                                                                                                                                                                            SHA1:3BC244518F863B754A97CA1B756580974C0D4356
                                                                                                                                                                                                                                            SHA-256:5252824225DDC486B0460677F765E4157AF5D3ED7ACD65B310A4045EAFB56AF7
                                                                                                                                                                                                                                            SHA-512:FF09177DCD695A185D66AFA8405EB7BF0883D4C1E6507F00A12CD958562E2F0444867F6DABDEE6E50CD5977897E4D878F31CB51888BA6878829C96CBF80FB283
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _STDBOOL_H.#define _STDBOOL_H../* ISOC99 boolean */..#define bool._Bool.#define true.1.#define false.0.#define __bool_true_false_are_defined 1..#endif /* _STDBOOL_H */.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\stddef.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1402
                                                                                                                                                                                                                                            Entropy (8bit):4.8724440555000506
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:d19VSrcs/mbR/4Cm+iOwHCFFfJNn9DAP6V2OCB6E7LuNcWmY/CDGAsC:5VSrH/TCeCFD59DGJUEnhzY/6GA9
                                                                                                                                                                                                                                            MD5:8B03F5DA84F6175FB1213C1208BB0944
                                                                                                                                                                                                                                            SHA1:FB7A374705241EE8BA4C59C6BD4829A97B90FA55
                                                                                                                                                                                                                                            SHA-256:C91FFAAEF5231C6D7E744E0700F1F429C9CFAD88A4112FDD5ABABB701F3B5A4B
                                                                                                                                                                                                                                            SHA-512:038DA70FFDA4BF66CDF6D0D6792F51B140B0E6EEC8351A286A51D454A81E0571779E16985519DAB47F3B48E6102A54A40101634B86F556C95C2128DC6AED4283
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _STDDEF_H.#define _STDDEF_H..typedef __SIZE_TYPE__ size_t;.typedef __PTRDIFF_TYPE__ ssize_t;.typedef __WCHAR_TYPE__ wchar_t;.typedef __PTRDIFF_TYPE__ ptrdiff_t;.typedef __PTRDIFF_TYPE__ intptr_t;.typedef __SIZE_TYPE__ uintptr_t;..#ifndef __int8_t_defined.#define __int8_t_defined.typedef signed char int8_t;.typedef signed short int int16_t;.typedef signed int int32_t;.#ifdef __LP64__.typedef signed long int int64_t;.#else.typedef signed long long int int64_t;.#endif.typedef unsigned char uint8_t;.typedef unsigned short int uint16_t;.typedef unsigned int uint32_t;.#ifdef __LP64__.typedef unsigned long int uint64_t;.#else.typedef unsigned long long int uint64_t;.#endif.#endif..#ifndef NULL.#define NULL ((void*)0).#endif..#define offsetof(type, field) ((size_t)&((type *)0)->field)..void *alloca(size_t size);..#endif../* Older glibc require a wint_t from <stddef.h> (when requested. by __need_wint_t, as otherwise stddef.h isn't allowed to. define this type). Note that this must

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\stdint.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6333
                                                                                                                                                                                                                                            Entropy (8bit):5.377774221268906
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Od4Q69/YQhMgPRVQzD+5VO7wRUNsNwxzMD2eT:Ou/f3Riz65VO7wRUNsNwxG
                                                                                                                                                                                                                                            MD5:90C1945AFA014FC0F8D17078C51502CA
                                                                                                                                                                                                                                            SHA1:F3A15DC3E32ED97B8CC34C1AFA2C66ECBA3B3BE4
                                                                                                                                                                                                                                            SHA-256:33C6C8DA7D564B5702AF8C6FF45C00A16842BA3FFE3F95F7F6232752F63C5AFD
                                                                                                                                                                                                                                            SHA-512:BE8557BDA158662ACC18CBD4445D4D2E6787FB5C78A67F0D0E4A62FFC9D2B1173C30C66CA5C6A247DA8FE7C38B7C57AFF050BD4A35B0120BD95400CFB4C2C2B6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./* ISO C9x 7.18 Integer types <stdint.h>. * Based on ISO/IEC SC22/WG14 9899 Committee draft (SC22 N2794). *. * THIS SOFTWARE IS NOT COPYRIGHTED. *. * Contributor: Danny Smith <danny_r_smith_2001@yahoo.co.nz>. *. * This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. *. * This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. *. * Date: 2000-12-02. */...#ifndef _STDINT_H.#define _STDINT_H..#include <_mingw.h>..#define __need_wint_t.#define __need_wchar_t.#include "stddef.h"..#ifndef __int8_t_defined.#define __int8_t

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\stdio.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14903
                                                                                                                                                                                                                                            Entropy (8bit):5.137879509844942
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:VgGovkt8YzcfdLDQgPVj85xhpp0DghdWRUeuzIDcDW40aMsGQLZX9QLbiR:KGr8ocfdL0w5shpwf40lsGQ6biR
                                                                                                                                                                                                                                            MD5:F4948ADEA7D9F60748DE8B427AB85684
                                                                                                                                                                                                                                            SHA1:101AD5424E182236EB7F537F17CE846C917CED27
                                                                                                                                                                                                                                            SHA-256:749059834143BCD5BDCEA13FC863C8B6587A89D6DFC84CD5017A98DF190DEFBD
                                                                                                                                                                                                                                            SHA-512:49847CA1A78BC100739B3AFC8A0D607AC37E340CEBBB0C04B2C067CDBDD6ED33AC5557214282699A89E39F4B8BB3A8B6383FC0A25C19265089E09B08765EA693
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDIO.#define _INC_STDIO..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#define BUFSIZ 512.#define _NFILE _NSTREAM_.#define _NSTREAM_ 512.#define _IOB_ENTRIES 20.#define EOF (-1)..#ifndef _FILE_DEFINED. struct _iobuf {. char *_ptr;. int _cnt;. char *_base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char *_tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifdef _POSIX_.#define _P_tmpdir "/".#define _wP_tmpdir L"/".#else.#define _P_tmpdir "\\".#define _wP_tmpdir L"\\".#endif..#define L_tmpnam (sizeof(_P_tmpdir) + 12)..#ifdef _POSIX_.#define L_ctermid 9.#define L_cuserid 32.#endif..#define SEEK_CUR 1.#define SEEK_END 2.#define SEEK_SET 0..#define STDIN_FILENO

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\stdlib.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20426
                                                                                                                                                                                                                                            Entropy (8bit):5.091356495974476
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:X5I7a44IVaadf7trkr6vrRcbCGX8XnaTjWb5:Uvf7trkr6vrRHaTjWb5
                                                                                                                                                                                                                                            MD5:53D74BF044942015FEC4AFD293D2F9A8
                                                                                                                                                                                                                                            SHA1:010AB014E3B81B3A7E2D1D87FF0281A8736A4ABC
                                                                                                                                                                                                                                            SHA-256:5BBA095A2D22A6BC0670F73BFEBBA63CFEC65F8B7C248E84E36B3D7EDE0A4F3C
                                                                                                                                                                                                                                            SHA-512:64B66F0D610D37E6F55702130FAD39F39D30F44D33221C6A985CD03948968D4C4CAFB7676402A9A4A029C8539EFBFA5801C0D1BCBF667B876F3E7BB08F9BF89F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STDLIB.#define _INC_STDLIB..#include <_mingw.h>.#include <limits.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#define EXIT_SUCCESS 0.#define EXIT_FAILURE 1..#ifndef _ONEXIT_T_DEFINED.#define _ONEXIT_T_DEFINED.. typedef int (__cdecl *_onexit_t)(void);..#ifndef NO_OLDNAMES.#define onexit_t _onexit_t.#endif.#endif..#ifndef _DIV_T_DEFINED.#define _DIV_T_DEFINED.. typedef struct _div_t {. int quot;. int rem;. } div_t;.. typedef struct _ldiv_t {. long quot;. long rem;. } ldiv_t;.#endif..#ifndef _CRT_DOUBLE_DEC.#define _CRT_DOUBLE_DEC..#pragma pack(4). typedef struct {. unsigned char ld[10];. } _LDOUBLE;.#pragma pack()..#defin

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\string.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                            Entropy (8bit):4.845158903423087
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:9SahrQ/tJUaRaV/f7WtxfeiZDHy6U4diocGLIvHKLhfyW7Ja0+8:9sJlS6H
                                                                                                                                                                                                                                            MD5:7E3AC3220BF883DA2DB8CDC7B8100D0B
                                                                                                                                                                                                                                            SHA1:666E6F91306EF6412AE912FA386B3DECC6332AD5
                                                                                                                                                                                                                                            SHA-256:D5C02C22653784792EEFF04CC453467BA22C214D9ACE876127EAB5FCCCBCA762
                                                                                                                                                                                                                                            SHA-512:1E27E9E73C5D3FBEC7CE41CB3B5FD6615BACC416991321BCE22B599150902352CF60078CD447BBBBD49F3106254C5E88E3FB01CA7DE62DA9A4DEDB6FD60F9B7A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STRING.#define _INC_STRING..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _NLSCMP_DEFINED.#define _NLSCMP_DEFINED.#define _NLSCMPERROR 2147483647.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void *__cdecl _memccpy(void *_Dst,const void *_Src,int _Val,size_t _MaxCount);. _CONST_RETURN void *__cdecl memchr(const void *_Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void *_Buf1,const void *_Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void *_Buf1,const void *_Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void *_Buf1,const void *_Bu

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\fcntl.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):359
                                                                                                                                                                                                                                            Entropy (8bit):4.783912410510983
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1nDA4bf1CAA9:UJJISFcShcFP+4B7SFRClV1ns4xCAA9
                                                                                                                                                                                                                                            MD5:26DAC89B148799164D02AC701AA67E91
                                                                                                                                                                                                                                            SHA1:018DB361295E5C140DE8131BB148A09ABA0E3532
                                                                                                                                                                                                                                            SHA-256:2B4F660FFD8994AFA0387407051E3CA7ECC8FE44BEB2ADD2D431CD52CE8AD9C4
                                                                                                                                                                                                                                            SHA-512:94BCF1A20D11ADF422B9A83521A5D6950ECA35144CDD719C9CBB483BFB9FC0E57D1BA02D29347A9006B25B1DAC746FDEE952BFDED1E55139586BB9D50386B8B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * This fcntl.h maps to the root fcntl.h. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\file.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):367
                                                                                                                                                                                                                                            Entropy (8bit):4.814423977077851
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1n6LACqMMf1CAA9:UJJISFcShcFP+4B7SFRClV1n/pHCAA9
                                                                                                                                                                                                                                            MD5:DA489932C3143982E94284F464F835CD
                                                                                                                                                                                                                                            SHA1:78FC0CCE2B7B047712B753AF6DF40258623D2620
                                                                                                                                                                                                                                            SHA-256:B6E779C53140C117BC36BD335C64BFCB13AE4C2C486B94783B32149A6EB2D320
                                                                                                                                                                                                                                            SHA-512:02ECE23C55D9C425F2B53C4D3AAFB7CE12B15995AB276CEFA9254C37499B0735FAF43EE32B67BF6A542EEC5147294BD5C16DFE51CAEFEC6C5B1C7807A4FD5858
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * This file.h maps to the root fcntl.h. * TODO?. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-2FR5R.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):351
                                                                                                                                                                                                                                            Entropy (8bit):4.8356374612162245
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1y19q/MqL9FPKvbf1CAARc:UJJISFcShcFP+4B7SFRClV1yoxFyvxCU
                                                                                                                                                                                                                                            MD5:244C135562D0B700D037299E0052A855
                                                                                                                                                                                                                                            SHA1:59F8A3B33C5CC8BBF95E4B57300628E7599DF682
                                                                                                                                                                                                                                            SHA-256:1F595A85CAEEEF7385A0BDA94AF51896B214EE26056484AF50353E9393DE1929
                                                                                                                                                                                                                                            SHA-512:1F5DEF177331B0E4DD86B5FC38FC9CF4F679BCA644C26C993D2A911DCF39DB452D084BF29D76430F5704E218CBCCD86D68F11D38C07B93A818EE446BA249EB53
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * unistd.h maps (roughly) to io.h. */.#ifndef __STRICT_ANSI__.#include <io.h>.#endif..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-D83K0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):367
                                                                                                                                                                                                                                            Entropy (8bit):4.814423977077851
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1n6LACqMMf1CAA9:UJJISFcShcFP+4B7SFRClV1n/pHCAA9
                                                                                                                                                                                                                                            MD5:DA489932C3143982E94284F464F835CD
                                                                                                                                                                                                                                            SHA1:78FC0CCE2B7B047712B753AF6DF40258623D2620
                                                                                                                                                                                                                                            SHA-256:B6E779C53140C117BC36BD335C64BFCB13AE4C2C486B94783B32149A6EB2D320
                                                                                                                                                                                                                                            SHA-512:02ECE23C55D9C425F2B53C4D3AAFB7CE12B15995AB276CEFA9254C37499B0735FAF43EE32B67BF6A542EEC5147294BD5C16DFE51CAEFEC6C5B1C7807A4FD5858
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * This file.h maps to the root fcntl.h. * TODO?. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-GC3NU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1717
                                                                                                                                                                                                                                            Entropy (8bit):5.134085097588011
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GIN024uIvNjYW0Q3VE9/6MLE0Rfn0AzMb:/02E18W0Q3+IclRf0nb
                                                                                                                                                                                                                                            MD5:D8BDDDB8A0B2E59371CE79EF056873C5
                                                                                                                                                                                                                                            SHA1:25F481B63F4343DCD56D2F15FE205F16BF008CB1
                                                                                                                                                                                                                                            SHA-256:518741F286545434DF676572E53BF8553B0496A7138942DC6B20FF252B4293E4
                                                                                                                                                                                                                                            SHA-512:4E009938EB6499F59022D1C2227A7E10FDE44C1CC4A38DE415B9E2C4E932E302C25845D68C6B2107CC037AB8053FE43350B2312A70130880004881E53EDB8F16
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _SYS_TIME_H_.#define _SYS_TIME_H_..#include <time.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef __STRICT_ANSI__.#ifndef _TIMEVAL_DEFINED /* also in winsock[2].h */.#define _TIMEVAL_DEFINED.struct timeval {. long tv_sec;. long tv_usec;.};.#define timerisset(tvp). ((tvp)->tv_sec || (tvp)->tv_usec).#define timercmp(tvp, uvp, cmp) \. (((tvp)->tv_sec != (uvp)->tv_sec) ? \. ((tvp)->tv_sec cmp (uvp)->tv_sec) : \. ((tvp)->tv_usec cmp (uvp)->tv_usec)).#define timerclear(tvp). (tvp)->tv_sec = (tvp)->tv_usec = 0.#endif /* _TIMEVAL_DEFINED */..#ifndef _TIMEZONE_DEFINED /* also in sys/time.h */.#define _TIMEZONE_DEFINED./* Provided for compatibility with code that assumes that. the presence of gettimeofday function implies a definition. of struct timezone. */.struc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-GK3MK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3429
                                                                                                                                                                                                                                            Entropy (8bit):5.0927661539295
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:0AqQeDbkF8080FQrkLt17kciYcTh6Wkcakc/Dk3Ih67k3R:0AVebbrShi1THhahrIIYIR
                                                                                                                                                                                                                                            MD5:0FD455848E3B07648883FF0C890BA3B6
                                                                                                                                                                                                                                            SHA1:22430C3CA7A2FABF95297BA72CA5FB175E37E996
                                                                                                                                                                                                                                            SHA-256:524312E3E8A325F7D5AFC21DDB8FCBCEB85D451175E07EF1BEADB7F82FA368B3
                                                                                                                                                                                                                                            SHA-512:53ADBB9316B7AD49BEF5018E3C32C10272A2D4A5CCF9A91D818D48C94C4DC4650ACC2AD462C2154E010E666B762B0B7F57BAD1A471830A0C5BB7422AFC62F840
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_UTIME.#define _INC_UTIME..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFIN

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-K79GF.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):359
                                                                                                                                                                                                                                            Entropy (8bit):4.783912410510983
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1nDA4bf1CAA9:UJJISFcShcFP+4B7SFRClV1ns4xCAA9
                                                                                                                                                                                                                                            MD5:26DAC89B148799164D02AC701AA67E91
                                                                                                                                                                                                                                            SHA1:018DB361295E5C140DE8131BB148A09ABA0E3532
                                                                                                                                                                                                                                            SHA-256:2B4F660FFD8994AFA0387407051E3CA7ECC8FE44BEB2ADD2D431CD52CE8AD9C4
                                                                                                                                                                                                                                            SHA-512:94BCF1A20D11ADF422B9A83521A5D6950ECA35144CDD719C9CBB483BFB9FC0E57D1BA02D29347A9006B25B1DAC746FDEE952BFDED1E55139586BB9D50386B8B3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * This fcntl.h maps to the root fcntl.h. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-OJ9TU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2128
                                                                                                                                                                                                                                            Entropy (8bit):5.025170221794001
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:G/uvbKQUIpV0OC1I/bFHb3wHbdyOkvk4QEa2K:WMKQ7V0/SFHDwHxkvkpExK
                                                                                                                                                                                                                                            MD5:C8F3B2F1FCF386398B5F130F0599A72E
                                                                                                                                                                                                                                            SHA1:242163A76E04F20CE4B3D5D0A959D66B978F43AD
                                                                                                                                                                                                                                            SHA-256:F1C3F9E5C811A63BEBAE5229042C09CB5E057F4117FD31B45AACBB4C3A626DF8
                                                                                                                                                                                                                                            SHA-512:3239360E2F810EBBB853581E01657A69BA9A56F6BBB29288011D6F842CE2C405D27A7D818C5E4809AE053481723DFA7DC37E4778EDFE6B6392884EB32804AA03
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_TYPES.#define _INC_TYPES..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED.typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T.typedef __time32_t time_t;.#else.typedef __time64_t time_t;.#endif.#endif..#ifndef _INO_T_DEFINED.#define _INO_T_DEFINED.typedef unsigned short _ino_t;.#ifndef.NO_OLDNAMES.typedef unsigned short ino_t;.#

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-TKIKU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):648
                                                                                                                                                                                                                                            Entropy (8bit):4.971114123290285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BFYLiSUfmMLGe2wAdcQr+VDRwrf7AIDjBArvjUOpy:i2PSh0PD+ivmMy4CVEABYjUOpy
                                                                                                                                                                                                                                            MD5:28BD6385B1C6AF18F7B2B2FA7F66827A
                                                                                                                                                                                                                                            SHA1:AD01251C9D742578F2962D71A17969DA842C5A2A
                                                                                                                                                                                                                                            SHA-256:29786145E9AF34A1F96E7368855B19E8879FC80D35A172D9BA97D3C7FC2F6311
                                                                                                                                                                                                                                            SHA-512:04DF92A3257B4A87FC1A00C65F700C6A9F4897FF3E258FBD27A3B3AD5426A35FAA7371735F829F4DA40E622E75A8259D4022F0F54BF8F52CA5ACFD234ED75CBE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_LOCKING.#define _INC_LOCKING..#ifndef _WIN32.#error Only Win32 target is supported!.#endif../* All the headers include this file. */.#include <_mingw.h>..#define _LK_UNLCK 0.#define _LK_LOCK 1.#define _LK_NBLCK 2.#define _LK_RLCK 3.#define _LK_NBRLCK 4..#ifndef.NO_OLDNAMES.#define LK_UNLCK _LK_UNLCK.#define LK_LOCK _LK_LOCK.#define LK_NBLCK _LK_NBLCK.#define LK_RLCK _LK_RLCK.#define LK_NBRLCK _LK_NBRLCK.#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-VCH4D.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2445
                                                                                                                                                                                                                                            Entropy (8bit):5.105161608995923
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GicuvBGmZ86+8nEGLEGzhlEG5/+Okvk4QEa2Mqh6CJ:srmZca/L/zf/5/AvkpExMqh6CJ
                                                                                                                                                                                                                                            MD5:19E8A20458A7627517AD83C0BE798773
                                                                                                                                                                                                                                            SHA1:FB12989D8B6B899F89F10E39559A46D79ADDEC65
                                                                                                                                                                                                                                            SHA-256:EF43F9F51660AB8282707F7169CC3D977878E623743D23EC565663FE2B4E9782
                                                                                                                                                                                                                                            SHA-512:4C21638910D0C87097E2FFC7B28B1011601E7B187297F9B9C2C3DB52596F84A0CFE089EF172A0DCDA0DCBE0B5B5DC94F36401A233CF7B903520C98B826A769DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIMEB_H_.#define _TIMEB_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __time64_t time_t;.#endif.#define _TIME_T_DEF

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\is-VK45T.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6881
                                                                                                                                                                                                                                            Entropy (8bit):5.0578662257513605
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:1Roa8xTSS9V89V0B9V69VP9VCJQI99wMupDGi+dpq+p:UdTSE44GPkfyDGi+Lq+p
                                                                                                                                                                                                                                            MD5:C03D618D6697B5E3992FEEA86A9C4CB8
                                                                                                                                                                                                                                            SHA1:4536CCD81AAEF11CF7480649B8B99836C8B32291
                                                                                                                                                                                                                                            SHA-256:4DC126AB4B3177DA85E40ED56A7D4516105E436A4624272992816B23E03915B5
                                                                                                                                                                                                                                            SHA-512:236235AA9B16B4CEB82C05BF526ECA702CB7D8C542F88D0BDB2416AC3BE8214688E6BA47BD253AAA877E173197035FD1EA7BF88AAE6C72C907E898182A5593C0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STAT.#define _INC_STAT..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#include <sys/types.h>..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __tim

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\locking.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):648
                                                                                                                                                                                                                                            Entropy (8bit):4.971114123290285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:UJJISFcShcFP+4BFYLiSUfmMLGe2wAdcQr+VDRwrf7AIDjBArvjUOpy:i2PSh0PD+ivmMy4CVEABYjUOpy
                                                                                                                                                                                                                                            MD5:28BD6385B1C6AF18F7B2B2FA7F66827A
                                                                                                                                                                                                                                            SHA1:AD01251C9D742578F2962D71A17969DA842C5A2A
                                                                                                                                                                                                                                            SHA-256:29786145E9AF34A1F96E7368855B19E8879FC80D35A172D9BA97D3C7FC2F6311
                                                                                                                                                                                                                                            SHA-512:04DF92A3257B4A87FC1A00C65F700C6A9F4897FF3E258FBD27A3B3AD5426A35FAA7371735F829F4DA40E622E75A8259D4022F0F54BF8F52CA5ACFD234ED75CBE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_LOCKING.#define _INC_LOCKING..#ifndef _WIN32.#error Only Win32 target is supported!.#endif../* All the headers include this file. */.#include <_mingw.h>..#define _LK_UNLCK 0.#define _LK_LOCK 1.#define _LK_NBLCK 2.#define _LK_RLCK 3.#define _LK_NBRLCK 4..#ifndef.NO_OLDNAMES.#define LK_UNLCK _LK_UNLCK.#define LK_LOCK _LK_LOCK.#define LK_NBLCK _LK_NBLCK.#define LK_RLCK _LK_RLCK.#define LK_NBRLCK _LK_NBRLCK.#endif..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\stat.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6881
                                                                                                                                                                                                                                            Entropy (8bit):5.0578662257513605
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:1Roa8xTSS9V89V0B9V69VP9VCJQI99wMupDGi+dpq+p:UdTSE44GPkfyDGi+Lq+p
                                                                                                                                                                                                                                            MD5:C03D618D6697B5E3992FEEA86A9C4CB8
                                                                                                                                                                                                                                            SHA1:4536CCD81AAEF11CF7480649B8B99836C8B32291
                                                                                                                                                                                                                                            SHA-256:4DC126AB4B3177DA85E40ED56A7D4516105E436A4624272992816B23E03915B5
                                                                                                                                                                                                                                            SHA-512:236235AA9B16B4CEB82C05BF526ECA702CB7D8C542F88D0BDB2416AC3BE8214688E6BA47BD253AAA877E173197035FD1EA7BF88AAE6C72C907E898182A5593C0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_STAT.#define _INC_STAT..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#include <sys/types.h>..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __tim

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\time.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1717
                                                                                                                                                                                                                                            Entropy (8bit):5.134085097588011
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GIN024uIvNjYW0Q3VE9/6MLE0Rfn0AzMb:/02E18W0Q3+IclRf0nb
                                                                                                                                                                                                                                            MD5:D8BDDDB8A0B2E59371CE79EF056873C5
                                                                                                                                                                                                                                            SHA1:25F481B63F4343DCD56D2F15FE205F16BF008CB1
                                                                                                                                                                                                                                            SHA-256:518741F286545434DF676572E53BF8553B0496A7138942DC6B20FF252B4293E4
                                                                                                                                                                                                                                            SHA-512:4E009938EB6499F59022D1C2227A7E10FDE44C1CC4A38DE415B9E2C4E932E302C25845D68C6B2107CC037AB8053FE43350B2312A70130880004881E53EDB8F16
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _SYS_TIME_H_.#define _SYS_TIME_H_..#include <time.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef __STRICT_ANSI__.#ifndef _TIMEVAL_DEFINED /* also in winsock[2].h */.#define _TIMEVAL_DEFINED.struct timeval {. long tv_sec;. long tv_usec;.};.#define timerisset(tvp). ((tvp)->tv_sec || (tvp)->tv_usec).#define timercmp(tvp, uvp, cmp) \. (((tvp)->tv_sec != (uvp)->tv_sec) ? \. ((tvp)->tv_sec cmp (uvp)->tv_sec) : \. ((tvp)->tv_usec cmp (uvp)->tv_usec)).#define timerclear(tvp). (tvp)->tv_sec = (tvp)->tv_usec = 0.#endif /* _TIMEVAL_DEFINED */..#ifndef _TIMEZONE_DEFINED /* also in sys/time.h */.#define _TIMEZONE_DEFINED./* Provided for compatibility with code that assumes that. the presence of gettimeofday function implies a definition. of struct timezone. */.struc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\timeb.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2445
                                                                                                                                                                                                                                            Entropy (8bit):5.105161608995923
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GicuvBGmZ86+8nEGLEGzhlEG5/+Okvk4QEa2Mqh6CJ:srmZca/L/zf/5/AvkpExMqh6CJ
                                                                                                                                                                                                                                            MD5:19E8A20458A7627517AD83C0BE798773
                                                                                                                                                                                                                                            SHA1:FB12989D8B6B899F89F10E39559A46D79ADDEC65
                                                                                                                                                                                                                                            SHA-256:EF43F9F51660AB8282707F7169CC3D977878E623743D23EC565663FE2B4E9782
                                                                                                                                                                                                                                            SHA-512:4C21638910D0C87097E2FFC7B28B1011601E7B187297F9B9C2C3DB52596F84A0CFE089EF172A0DCDA0DCBE0B5B5DC94F36401A233CF7B903520C98B826A769DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIMEB_H_.#define _TIMEB_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __time64_t time_t;.#endif.#define _TIME_T_DEF

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\types.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2128
                                                                                                                                                                                                                                            Entropy (8bit):5.025170221794001
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:G/uvbKQUIpV0OC1I/bFHb3wHbdyOkvk4QEa2K:WMKQ7V0/SFHDwHxkvkpExK
                                                                                                                                                                                                                                            MD5:C8F3B2F1FCF386398B5F130F0599A72E
                                                                                                                                                                                                                                            SHA1:242163A76E04F20CE4B3D5D0A959D66B978F43AD
                                                                                                                                                                                                                                            SHA-256:F1C3F9E5C811A63BEBAE5229042C09CB5E057F4117FD31B45AACBB4C3A626DF8
                                                                                                                                                                                                                                            SHA-512:3239360E2F810EBBB853581E01657A69BA9A56F6BBB29288011D6F842CE2C405D27A7D818C5E4809AE053481723DFA7DC37E4778EDFE6B6392884EB32804AA03
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_TYPES.#define _INC_TYPES..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED.typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T.typedef __time32_t time_t;.#else.typedef __time64_t time_t;.#endif.#endif..#ifndef _INO_T_DEFINED.#define _INO_T_DEFINED.typedef unsigned short _ino_t;.#ifndef.NO_OLDNAMES.typedef unsigned short ino_t;.#

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\unistd.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):351
                                                                                                                                                                                                                                            Entropy (8bit):4.8356374612162245
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1y19q/MqL9FPKvbf1CAARc:UJJISFcShcFP+4B7SFRClV1yoxFyvxCU
                                                                                                                                                                                                                                            MD5:244C135562D0B700D037299E0052A855
                                                                                                                                                                                                                                            SHA1:59F8A3B33C5CC8BBF95E4B57300628E7599DF682
                                                                                                                                                                                                                                            SHA-256:1F595A85CAEEEF7385A0BDA94AF51896B214EE26056484AF50353E9393DE1929
                                                                                                                                                                                                                                            SHA-512:1F5DEF177331B0E4DD86B5FC38FC9CF4F679BCA644C26C993D2A911DCF39DB452D084BF29D76430F5704E218CBCCD86D68F11D38C07B93A818EE446BA249EB53
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */./*. * This file is part of the Mingw32 package.. *. * unistd.h maps (roughly) to io.h. */.#ifndef __STRICT_ANSI__.#include <io.h>.#endif..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\sys\utime.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3429
                                                                                                                                                                                                                                            Entropy (8bit):5.0927661539295
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:0AqQeDbkF8080FQrkLt17kciYcTh6Wkcakc/Dk3Ih67k3R:0AVebbrShi1THhahrIIYIR
                                                                                                                                                                                                                                            MD5:0FD455848E3B07648883FF0C890BA3B6
                                                                                                                                                                                                                                            SHA1:22430C3CA7A2FABF95297BA72CA5FB175E37E996
                                                                                                                                                                                                                                            SHA-256:524312E3E8A325F7D5AFC21DDB8FCBCEB85D451175E07EF1BEADB7F82FA368B3
                                                                                                                                                                                                                                            SHA-512:53ADBB9316B7AD49BEF5018E3C32C10272A2D4A5CCF9A91D818D48C94C4DC4650ACC2AD462C2154E010E666B762B0B7F57BAD1A471830A0C5BB7422AFC62F840
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_UTIME.#define _INC_UTIME..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef __TINYC__ /* gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFIN

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\tcc\is-M6HOQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, Unicode text, UTF-8 text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5780
                                                                                                                                                                                                                                            Entropy (8bit):5.046971371476785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:jlnbfJdTPPut0CQHXOiNZIZvYx6G5Pcz3mZqZ9VZ59uxS34n3C3:NfJdSbQHXVNiVYx6G5Y3UO9VFuxS34A
                                                                                                                                                                                                                                            MD5:7166D4B47303E4DC38EBEAE8B204075F
                                                                                                                                                                                                                                            SHA1:FA0341B00479D682C8A398E8EC1C6D4D7FC2D05A
                                                                                                                                                                                                                                            SHA-256:758E0585EDFBCE44BF27E0BB44D9B22AF53B86C9C265E4303DF9B270194ED4FF
                                                                                                                                                                                                                                            SHA-512:4A4DF260266B6F17DA29E71254969DBE377CC11BADE3513BAB1F3B767CE049C9BBE1B0656263763BFB5D10C9D325B425364F000BAA4342572556716B857E796D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _TCC_LIBM_H_.#define _TCC_LIBM_H_..#include "../math.h"../* TCC uses 8 bytes for double and long double, so effectively the l variants. * are never used. For now, they just run the normal (double) variant.. */../*. * most of the code in this file is taken from MUSL rs-1.0 (MIT license). * - musl-libc: http://git.musl-libc.org/cgit/musl/tree/src/math?h=rs-1.0. * - License: http://git.musl-libc.org/cgit/musl/tree/COPYRIGHT?h=rs-1.0. */../*******************************************************************************. Start of code based on MUSL.*******************************************************************************/./*.musl as a whole is licensed under the following standard MIT license:..----------------------------------------------------------------------.Copyright . 2005-2014 Rich Felker, et al...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\tcc\tcc_libm.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, Unicode text, UTF-8 text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5780
                                                                                                                                                                                                                                            Entropy (8bit):5.046971371476785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:jlnbfJdTPPut0CQHXOiNZIZvYx6G5Pcz3mZqZ9VZ59uxS34n3C3:NfJdSbQHXVNiVYx6G5Y3UO9VFuxS34A
                                                                                                                                                                                                                                            MD5:7166D4B47303E4DC38EBEAE8B204075F
                                                                                                                                                                                                                                            SHA1:FA0341B00479D682C8A398E8EC1C6D4D7FC2D05A
                                                                                                                                                                                                                                            SHA-256:758E0585EDFBCE44BF27E0BB44D9B22AF53B86C9C265E4303DF9B270194ED4FF
                                                                                                                                                                                                                                            SHA-512:4A4DF260266B6F17DA29E71254969DBE377CC11BADE3513BAB1F3B767CE049C9BBE1B0656263763BFB5D10C9D325B425364F000BAA4342572556716B857E796D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#ifndef _TCC_LIBM_H_.#define _TCC_LIBM_H_..#include "../math.h"../* TCC uses 8 bytes for double and long double, so effectively the l variants. * are never used. For now, they just run the normal (double) variant.. */../*. * most of the code in this file is taken from MUSL rs-1.0 (MIT license). * - musl-libc: http://git.musl-libc.org/cgit/musl/tree/src/math?h=rs-1.0. * - License: http://git.musl-libc.org/cgit/musl/tree/COPYRIGHT?h=rs-1.0. */../*******************************************************************************. Start of code based on MUSL.*******************************************************************************/./*.musl as a whole is licensed under the following standard MIT license:..----------------------------------------------------------------------.Copyright . 2005-2014 Rich Felker, et al...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\tccdefs.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10222
                                                                                                                                                                                                                                            Entropy (8bit):5.118611530215232
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:cwxjJoLCBGnjq/Kn4aq3qvsbLJKr7nnJik1gngZxl9e7PpTGO+HT7R8AitqazIh5:cwzbLJyLnJ6O8PpTGOEiNzIhIbIXP3JF
                                                                                                                                                                                                                                            MD5:ACE688BCE0201B3B8BC3B7AF3CEC1BA7
                                                                                                                                                                                                                                            SHA1:7B967DE03772076207537292C4163994D4EAD095
                                                                                                                                                                                                                                            SHA-256:FACA8509C87FAE987A5E98CDC95171E036895037427D12930E2A83092D23FBB5
                                                                                                                                                                                                                                            SHA-512:A83753F6A1B82BCDFCF0B948C93F2E09A0A13105A112C161ABAD6DE84162DA67600CF5458FF51264DDC462077033DE3C8496E7B2251831871005D747AE58A24A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/* tccdefs.h.... Nothing is defined before this file except target machine, target os.. and the few things related to option settings in tccpp.c:tcc_predefs()..... This file is either included at runtime as is, or converted and.. included as C-strings at compile-time (depending on CONFIG_TCC_PREDEFS)..... Note that line indent matters:.... - in lines starting at column 1, platform macros are replaced by.. corresponding TCC target compile-time macros. See conftest.c for.. the list of platform macros supported in lines starting at column 1..... - only lines indented >= 4 are actually included into the executable,.. check tccdefs_.h...*/....#if __SIZEOF_POINTER__ == 4.. /* 32bit systems. */..#if defined TARGETOS_OpenBSD.. #define __SIZE_TYPE__ unsigned long.. #define __PTRDIFF_TYPE__ long..#else.. #define __SIZE_TYPE__ unsigned int.. #define __PTRDIFF_TYPE__ int..#endif.. #define __ILP32__ 1.. #define __INT64_TYPE__ long long..#el

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\tchar.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):31364
                                                                                                                                                                                                                                            Entropy (8bit):4.752286291497649
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:ngntwzzdfQQbqvoRFCM/CVwLn4wyQoPUQ:PzdfQQbqvo1UwNoPUQ
                                                                                                                                                                                                                                            MD5:E237270733EDC1CB97B10870A3D50A69
                                                                                                                                                                                                                                            SHA1:C2406D465B5E8D94E1CB61C6C3F312BDB018AC80
                                                                                                                                                                                                                                            SHA-256:7FE5FDE028FF8F69D2BDA910664E2C169E7B92C6E7F2CF7915EB72054A9746FF
                                                                                                                                                                                                                                            SHA-512:8DF9ADD42AD3C8C378E93AF4BEC69489D59B8088974A40EC04FB91749DC050E3000674C9388FAE9937F87D6ABB60199B13D179BF0A8654370A66DB64CDD2E1B1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#ifndef _INC_TCHAR.#define _INC_TCHAR..#ifdef _STRSAFE_H_INCLUDED_.#error Need to include strsafe.h after tchar.h.#endif..#ifdef __cplusplus.extern "C" {.#endif..#define _ftcscat _tcscat.#define _ftcschr _tcschr.#define _ftcscpy _tcscpy.#define _ftcscspn _tcscspn.#define _ftcslen _tcslen.#define _ftcsncat _tcsncat.#define _ftcsncpy _tcsncpy.#define _ftcspbrk _tcspbrk.#define _ftcsrchr _tcsrchr.#define _ftcsspn _tcsspn.#define _ftcsstr _tcsstr.#define _ftcstok _tcstok..#define _ftcsdup _tcsdup.#define _ftcsnset _tcsnset.#define _ftcsrev _tcsrev.#define _ftcsset _tcsset..#define _ftcscmp _tcscmp.#define _ftcsicmp _tcsicmp.#define _ftcsnccmp _tcsnccmp.#define _ftcsncmp _tcsncmp.#define _ftcsncicmp _tcsncicmp.#define _ftcsnicmp _tcsnicmp..#define _ftcscoll _tc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\time.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8405
                                                                                                                                                                                                                                            Entropy (8bit):5.100723832842219
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:0ih8Bf8Bx8B6qwyKg758H898Bc8BQGDL2XMR6fm4RFeU6sxhE2JFE:0G8Bf8Bx8Bxwyz58O8Bc8Bv208m4RFeD
                                                                                                                                                                                                                                            MD5:698EA0C0196BA07E9B949406DBB9FFD7
                                                                                                                                                                                                                                            SHA1:7296CFE82FAB54F08D44CE9CBAB92BEF7D96C96E
                                                                                                                                                                                                                                            SHA-256:453793A2D6C6FC772D1CDD60E701FB3D393D752937C1D6B2CA64D5F1CEC9FD36
                                                                                                                                                                                                                                            SHA-512:49984DDD4866060D8E310CA6A2BD53DEA87ABA70778202C5EFED126C35B244DF90C42D61477775F327B30597138A73FB2B2EE2E1050DC6732FAEB766E870C146
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIME_H_.#define _TIME_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED.#define _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.#if defined(__GNUC__) && defined(__STRICT_ANSI__). typedef int _time64_t __attribute__ ((mode (DI)));.#else. typedef __int64 __time64_t;.#endif.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typ

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\vadefs.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):304
                                                                                                                                                                                                                                            Entropy (8bit):4.976431807239841
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2n2ADbA96Iy/KTMk:UJJISFcShcFP+4BbHYPSN
                                                                                                                                                                                                                                            MD5:DDA4463DA15121ED7AD4F091FBF61DFF
                                                                                                                                                                                                                                            SHA1:84B4C4973306EF725C3F61446AB891CAC6AA66A4
                                                                                                                                                                                                                                            SHA-256:2E6AB359559319A11A80F8F52AA0472CD0B141137F3A1EAA18C40D8827DC51D4
                                                                                                                                                                                                                                            SHA-512:D3417CF7702A17F0F327CBAF8D167D7830A2955C19D553893329696CDF2312707595CF0F6DDAA36EA18D0CEA41F24E6FA9C15AC14D5BC567BC25A1CC81B733FE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_VADEFS.#define _INC_VADEFS..//!__TINYC__: GNUC specific stuff removed..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\values.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):126
                                                                                                                                                                                                                                            Entropy (8bit):4.580595223579644
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:UwqZKUaAJAtMLnKEwOEtLDLaF9rL4AsNXIC:Uwq1LJvnKEcXaF94FNXIC
                                                                                                                                                                                                                                            MD5:621045AE9CA57FE30C8A99DD52AC5703
                                                                                                                                                                                                                                            SHA1:39B1E30A678EAC4DF1B78C0EF9D315A18DF4F156
                                                                                                                                                                                                                                            SHA-256:FA3758847B33F59ABE99B023BE00D8A027C391ECD0580A1FE755497C11E0C723
                                                                                                                                                                                                                                            SHA-512:AADE260048487D82F129A9A51FBDEA949793465C33DC147B31943D22523FB1A63C48F80FCA370D5929BCCA76B89CD15D9786C439A65C396BB4A5416D387E3F3A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*. * TODO: Nothing here yet. Should provide UNIX compatibility constants. * comparable to those in limits.h and float.h.. */.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\varargs.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):355
                                                                                                                                                                                                                                            Entropy (8bit):4.9174278150037285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2Ti2F0A/ivi+M8WjTffBX5FoKtn+cs:UJJISFcShcFP+4B6Xr/qi+MHjjfBcKta
                                                                                                                                                                                                                                            MD5:8C659FCB5BA111C2A40716A84A2540D8
                                                                                                                                                                                                                                            SHA1:20069AF3A3805CF4CB05339F7A7A860F04A1E4B9
                                                                                                                                                                                                                                            SHA-256:07858857F4EED0A61DF94BEB1A9D678B53FC3D67A0B0E8936155F85DDBCD1DCC
                                                                                                                                                                                                                                            SHA-512:D1B19DEC523C79320BB3380F29981A49EFB178F06C0538BCE0A5B36AFEABEC9BE0F2A9D02436EDF2AC0970CB14B175B3387BBB14A1E5F62EEC9971C0C7648A99
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _VARARGS_H.#define _VARARGS_H..#error "TinyCC no longer implements <varargs.h>.".#error "Revise your code to use <stdarg.h>."..#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\wchar.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):34132
                                                                                                                                                                                                                                            Entropy (8bit):5.065285191271868
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:2186Orc7LIJ8SNgVx6eG17k8MGOHlE4eGP0+aILsGQ86jWIwF2iiEYbS:2IcE8SNgVx61JC6jry2E
                                                                                                                                                                                                                                            MD5:D6B25F8E3068967751493431B36C4248
                                                                                                                                                                                                                                            SHA1:3145ED71F286525D1FF492AE920B30694123259E
                                                                                                                                                                                                                                            SHA-256:C9BF12E02A2AB0783ED1C66DFE43DE43C402B33906CADA9B1157502A82C7C3E4
                                                                                                                                                                                                                                            SHA-512:02A480389CECC909978130585609F57D03728726E72E5FEE89874ACCA4122D971D74FC615949F8675513EDCFE3198201AD0118F795B147C6FCA10D28E8856645
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_WCHAR.#define _INC_WCHAR..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WCHAR_MIN /* also at stdint.h */.#define WCHAR_MIN 0.#define WCHAR_MAX ((wchar_t) -1) /* UINT16_MAX */.#endif..#ifndef __GNUC_VA_LIST.#define __GNUC_VA_LIST. typedef __builtin_va_list __gnuc_va_list;.#endif..#ifndef _VA_LIST_DEFINED.#define _VA_LIST_DEFINED. typedef __gnuc_va_list va_list;.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _FILE_DEFINED. struct _iobuf {. char *_ptr;. int _cnt;. char *_base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char *_tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifndef _STDIO_DEFINED.#ifdef _WIN64. _CRTIMP FILE *__

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\wctype.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4782
                                                                                                                                                                                                                                            Entropy (8bit):5.146949090032166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:4+KnaNsLsNwnSTOXNXgXXXVX+1XPXmXIX6QXJX9XZXdwUSv:4+KA6O6XNXgXXXVXkXPXmXIXfXJX9XZK
                                                                                                                                                                                                                                            MD5:C238CFA11A44926BECD364AB35BFC821
                                                                                                                                                                                                                                            SHA1:54D68B8EF71D277BD5173E0AAC794D6EBDB00360
                                                                                                                                                                                                                                            SHA-256:E12D9C5BCBE4DFB96EA6C75410EA287917B3C24BFF9CD2E716D35E00C1D4906C
                                                                                                                                                                                                                                            SHA-512:C64F6A3B18D84C8498A2270E7152C4001D6D7EE1ACD04169F616A7808A05A02F34E2876BA0CB8D979AE75752109B50A65A66207C86FE936402BDA39AC93833C0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_WCTYPE.#define _INC_WCTYPE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef _WCTYPE_T_DEFINED. typedef unsigned short wint_t;. typedef unsigned short wctype_t;.#define _WCTYPE_T_DEFINED.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func() (_pctype).#else.#define __pctype_func() (*_imp___pctype).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\basetsd.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5614
                                                                                                                                                                                                                                            Entropy (8bit):5.234194137175846
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:xOYJhN+GRWlYdGmc0/5ZLURGFVwae+NmZLaVkGMGMRRMhHmdd7sAKGU1LRlw+4i7:xO8hIGRWl6Gmc0hw8Vre+NmcVk5rSHIQ
                                                                                                                                                                                                                                            MD5:4BF8483CA6A55237B88B3FB04917C9B4
                                                                                                                                                                                                                                            SHA1:1D5A57A8AF15FF88521335970F6C547EB2BDA403
                                                                                                                                                                                                                                            SHA-256:5C9CBAA16ABF57400ED31B49AAB7EE015788DBE7D3B58F3D53C86DB3807DD6F0
                                                                                                                                                                                                                                            SHA-512:7C4E012EF32A9529A0FA648320796D2ABB287C3C37F22D2CFEFE62FD0851CF68B5D373316AD70B51D09F0D0F1F48843A5D6E430C12367B5363648EEFF1160466
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _BASETSD_H_.#define _BASETSD_H_..#if (defined(__x86_64) || defined(__ia64__)) && !defined(RC_INVOKED).typedef unsigned __int64 POINTER_64_INT;.#else.typedef unsigned long POINTER_64_INT;.#endif..#define POINTER_32.#define POINTER_64.#define FIRMWARE_PTR..#ifdef __cplusplus.extern "C" {.#endif.. typedef signed char INT8,*PINT8;. typedef signed short INT16,*PINT16;. typedef signed int INT32,*PINT32;. typedef signed __int64 INT64,*PINT64;. typedef unsigned char UINT8,*PUINT8;. typedef unsigned short UINT16,*PUINT16;. typedef unsigned int UINT32,*PUINT32;. typedef unsigned __int64 UINT64,*PUINT64;. typedef signed int LONG32,*PLONG32;. typedef unsigned int ULONG32,*PULONG32;. typedef unsigned int DWORD32,*PDWORD32;..#ifndef _W64.#define _W64.#endif..#ifdef _WIN64

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\basetyps.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2413
                                                                                                                                                                                                                                            Entropy (8bit):5.267985342570529
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:G+qAaBjES2EZs96PiYkAahW4h+gt/04hOgldUOkke:TqAuEThH3Vy
                                                                                                                                                                                                                                            MD5:09DFC50C697476FDC240969717C514CE
                                                                                                                                                                                                                                            SHA1:C9D444C897A96A4B475379C7C6B826FDF2DFF2E5
                                                                                                                                                                                                                                            SHA-256:34842EE3389CB13A72A2B87EC930AADBFFCE8906EB31480180CFF541C7F44134
                                                                                                                                                                                                                                            SHA-512:DE3E258D4DF8E046A131110FADAC12572CA14A7359F1C44C41DEBC7E8F1424A93BEC6300E3CA21BEEB55FF4B3AB572F0B3059D9399C89CFF27D154DCC90238F7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !defined(_BASETYPS_H_).#define _BASETYPS_H_..#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif..#define STDMETHODCALLTYPE WINAPI.#define STDMETHODVCALLTYPE __cdecl..#define STDAPICALLTYPE WINAPI.#define STDAPIVCALLTYPE __cdecl..#define STDAPI EXTERN_C HRESULT WINAPI.#define STDAPI_(type) EXTERN_C type WINAPI..#define STDMETHODIMP HRESULT WINAPI.#define STDMETHODIMP_(type) type WINAPI..#define STDAPIV EXTERN_C HRESULT STDAPIVCALLTYPE.#define STDAPIV_(type) EXTERN_C type STDAPIVCALLTYPE..#define STDMETHODIMPV HRESULT STDMETHODVCALLTYPE.#define STDMETHODIMPV_(type) type STDMETHODVCALLTYPE..#if defined(__cplusplus) && !defined(CINTERFACE)..#define __STRUCT__ struct.#define STDMETHOD(method) virtual HRESULT WINAPI method.#define STDMETHOD_(type

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\guiddef.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4165
                                                                                                                                                                                                                                            Entropy (8bit):5.37405161812663
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:lVeZAP1SQySDz25/rPjEgE+2VPYFjrQUnL:lVe01S9kNcH
                                                                                                                                                                                                                                            MD5:D65FFFB282C1F60CCBFC4DCF1410BE1F
                                                                                                                                                                                                                                            SHA1:2BE8BADB6C6FB0DB0B023BFBC7B6842E0AB73A8F
                                                                                                                                                                                                                                            SHA-256:7DB1B1FE46513F578A3C777C3CE300D8403D31FBFB6D00EACFF93286D2ED1293
                                                                                                                                                                                                                                            SHA-512:E7F9554980671DCB14C62FF462AE34961C01E0DD1AFA9F8E010370B0941E22BA619ABEA98DCE090762888A1E485586BAAA0917167FF6373C8309374EBCE8054F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef GUID_DEFINED.#define GUID_DEFINED.typedef struct _GUID {. unsigned long Data1;. unsigned short Data2;. unsigned short Data3;. unsigned char Data4[8 ];.} GUID;.#endif..#ifndef UUID_DEFINED.#define UUID_DEFINED.typedef GUID UUID;.#endif..#ifndef FAR.#define FAR.#endif..#ifndef DECLSPEC_SELECTANY.#define DECLSPEC_SELECTANY __declspec(selectany).#endif..#ifndef EXTERN_C.#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif.#endif..#ifdef DEFINE_GUID.#undef DEFINE_GUID.#endif..#ifdef INITGUID.#ifdef __cplusplus.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) EXTERN_C const GUID DECLSPEC_SELECTANY name = { l,w1,w2,{ b1,b2,b3,b4,b5,b6,b7,b8 } }.#else.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) const GUID DECLSPEC_SELEC

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-1NE8J.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.932449945638745
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3iV:UJJISFcShcFP+4BnWKi3iV
                                                                                                                                                                                                                                            MD5:9E2E16A461B193BAE9E69C59C9A3E040
                                                                                                                                                                                                                                            SHA1:17AAA9161D3F9D7270EDB80BC850B3AD1CD9151A
                                                                                                                                                                                                                                            SHA-256:CD3BA1258A5DD9C714879D3E499B021C85EE9827C06BAC2FC2C1E677B5909531
                                                                                                                                                                                                                                            SHA-512:37C580B406EB30FC66B0135D91D8DC743A9F2ABBF830A58272ECF910E4F4BDE10ED9A1CF07A8C0F24BFA2D8E86883AF76C5A7805FC70A2AE69F1A9D8225774DF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,4).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-2AHB0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5614
                                                                                                                                                                                                                                            Entropy (8bit):5.234194137175846
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:xOYJhN+GRWlYdGmc0/5ZLURGFVwae+NmZLaVkGMGMRRMhHmdd7sAKGU1LRlw+4i7:xO8hIGRWl6Gmc0hw8Vre+NmcVk5rSHIQ
                                                                                                                                                                                                                                            MD5:4BF8483CA6A55237B88B3FB04917C9B4
                                                                                                                                                                                                                                            SHA1:1D5A57A8AF15FF88521335970F6C547EB2BDA403
                                                                                                                                                                                                                                            SHA-256:5C9CBAA16ABF57400ED31B49AAB7EE015788DBE7D3B58F3D53C86DB3807DD6F0
                                                                                                                                                                                                                                            SHA-512:7C4E012EF32A9529A0FA648320796D2ABB287C3C37F22D2CFEFE62FD0851CF68B5D373316AD70B51D09F0D0F1F48843A5D6E430C12367B5363648EEFF1160466
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _BASETSD_H_.#define _BASETSD_H_..#if (defined(__x86_64) || defined(__ia64__)) && !defined(RC_INVOKED).typedef unsigned __int64 POINTER_64_INT;.#else.typedef unsigned long POINTER_64_INT;.#endif..#define POINTER_32.#define POINTER_64.#define FIRMWARE_PTR..#ifdef __cplusplus.extern "C" {.#endif.. typedef signed char INT8,*PINT8;. typedef signed short INT16,*PINT16;. typedef signed int INT32,*PINT32;. typedef signed __int64 INT64,*PINT64;. typedef unsigned char UINT8,*PUINT8;. typedef unsigned short UINT16,*PUINT16;. typedef unsigned int UINT32,*PUINT32;. typedef unsigned __int64 UINT64,*PUINT64;. typedef signed int LONG32,*PLONG32;. typedef unsigned int ULONG32,*PULONG32;. typedef unsigned int DWORD32,*PDWORD32;..#ifndef _W64.#define _W64.#endif..#ifdef _WIN64

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-2DD8C.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):159607
                                                                                                                                                                                                                                            Entropy (8bit):5.448523174174419
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:p8iWoUKAVEvTQ/BUNRB+NNKjxyfmTcFqTPj:p8iWoUKAVEvTQmcFqTPj
                                                                                                                                                                                                                                            MD5:18908ACE3445091E5966CC99F9D4B5B9
                                                                                                                                                                                                                                            SHA1:130D1CFA2D8A8A17FA2AFA4DDF4FE3DFBA4542D5
                                                                                                                                                                                                                                            SHA-256:47EFFBA4D4BB7DFBE373F1156285A170042FE1A3552BCBBEE460E5DB68E1FF2D
                                                                                                                                                                                                                                            SHA-512:0E63D752B56051057C4E553307A708C2359EAC58EA96EA0077931642482EB8B6E0B28984A278663D85C6B1739564CAB6FFED3D9582306473841A355BD0CBEE61
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINBASE_.#define _WINBASE_..#define WINADVAPI DECLSPEC_IMPORT.#define WINBASEAPI DECLSPEC_IMPORT.#define ZAWPROXYAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#define DefineHandleTable(w) ((w),TRUE).#define LimitEmsPages(dw).#define SetSwapAreaSize(w) (w).#define LockSegment(w) GlobalFix((HANDLE)(w)).#define UnlockSegment(w) GlobalUnfix((HANDLE)(w)).#define GetCurrentTime() GetTickCount()..#define Yield()..#define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1).#define INVALID_FILE_SIZE ((DWORD)0xffffffff).#define INVALID_SET_FILE_POINTER ((DWORD)-1).#define INVALID_FILE_ATTRIBUTES ((DWORD)-1)..#define FILE_BEGIN 0.#define FILE_CURRENT 1.#define FILE_END 2..#define TIME_ZONE_ID_INVALID ((DWORD)0xffffffff)..#define WAIT_FAILED ((DWORD)0xffffffff).#define WAI

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-3D26K.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.939467489498393
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3kJuy:UJJISFcShcFP+4BnWKi3suy
                                                                                                                                                                                                                                            MD5:5F9BA2A3122F6963219BDD95EFF0D63B
                                                                                                                                                                                                                                            SHA1:FC7EF1DBF2D51D9E38E79BC4D2DFE7F89107263E
                                                                                                                                                                                                                                            SHA-256:D459CBD546929FD44980D32C1680A8F176D717CE9DF162F5C5C443DFDCCC9E42
                                                                                                                                                                                                                                            SHA-512:4339E932DA337FC33CB8544FAD3065F82F689E17AE9CFD6A3035A0A1C62271ED0EFC44553A75C29207E97555E55FF8F76D42FBEF57B46B0E117B087A367A5D1F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,2).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-426B0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):121301
                                                                                                                                                                                                                                            Entropy (8bit):5.419416589760816
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:mmN0oz+ODr15Ye92/rvZVXkRs4pItxtv7OosWBkEwJaYygZtk+tUtwtmtDlwsigp:nuPn7z57mW7T1QFYLCOdKSbuo8Sl
                                                                                                                                                                                                                                            MD5:FD80383F6F92379E074379BA54D68BDC
                                                                                                                                                                                                                                            SHA1:0A4D4926DF853E126FCC52150C84822AF1EF8035
                                                                                                                                                                                                                                            SHA-256:DF5937AC1805B27ABBA03277D2C34CAEE8CB4387EDB894ADCD73E6172A9FBD94
                                                                                                                                                                                                                                            SHA-512:4ED6C5508C77A8A3272835C6AE1323514E42D015F3CB53168382FFD78FB1A73D806AF5421378D1430ED344BA1200E3006D5AAF4150E925C1F2267A8D637A50A4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINGDI_.#define _WINGDI_..#define WINGDIAPI DECLSPEC_IMPORT.#define WINSPOOLAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef NOGDI.#ifndef NORASTEROPS.#define R2_BLACK 1.#define R2_NOTMERGEPEN 2.#define R2_MASKNOTPEN 3.#define R2_NOTCOPYPEN 4.#define R2_MASKPENNOT 5.#define R2_NOT 6.#define R2_XORPEN 7.#define R2_NOTMASKPEN 8.#define R2_MASKPEN 9.#define R2_NOTXORPEN 10.#define R2_NOP 11.#define R2_MERGENOTPEN 12.#define R2_COPYPEN 13.#define R2_MERGEPENNOT 14.#define R2_MERGEPEN 15.#define R2_WHITE 16.#define R2_LAST 16..#define SRCCOPY (DWORD)0x00CC0020.#define SRCPAINT (DWORD)0x00EE0086.#define SRCAND (DWORD)0x008800C6.#define SRCINVERT (DWORD)0x00660046.#define SRCERASE (DWORD)0x00440328.#define NOTS

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-4KLA5.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2413
                                                                                                                                                                                                                                            Entropy (8bit):5.267985342570529
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:G+qAaBjES2EZs96PiYkAahW4h+gt/04hOgldUOkke:TqAuEThH3Vy
                                                                                                                                                                                                                                            MD5:09DFC50C697476FDC240969717C514CE
                                                                                                                                                                                                                                            SHA1:C9D444C897A96A4B475379C7C6B826FDF2DFF2E5
                                                                                                                                                                                                                                            SHA-256:34842EE3389CB13A72A2B87EC930AADBFFCE8906EB31480180CFF541C7F44134
                                                                                                                                                                                                                                            SHA-512:DE3E258D4DF8E046A131110FADAC12572CA14A7359F1C44C41DEBC7E8F1424A93BEC6300E3CA21BEEB55FF4B3AB572F0B3059D9399C89CFF27D154DCC90238F7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !defined(_BASETYPS_H_).#define _BASETYPS_H_..#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif..#define STDMETHODCALLTYPE WINAPI.#define STDMETHODVCALLTYPE __cdecl..#define STDAPICALLTYPE WINAPI.#define STDAPIVCALLTYPE __cdecl..#define STDAPI EXTERN_C HRESULT WINAPI.#define STDAPI_(type) EXTERN_C type WINAPI..#define STDMETHODIMP HRESULT WINAPI.#define STDMETHODIMP_(type) type WINAPI..#define STDAPIV EXTERN_C HRESULT STDAPIVCALLTYPE.#define STDAPIV_(type) EXTERN_C type STDAPIVCALLTYPE..#define STDMETHODIMPV HRESULT STDMETHODVCALLTYPE.#define STDMETHODIMPV_(type) type STDMETHODVCALLTYPE..#if defined(__cplusplus) && !defined(CINTERFACE)..#define __STRUCT__ struct.#define STDMETHOD(method) virtual HRESULT WINAPI method.#define STDMETHOD_(type

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-6MAEC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5381
                                                                                                                                                                                                                                            Entropy (8bit):5.237607493279814
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:EtGsCwPV1Ihot5C5snyv5vdQSZWVvc22c26T9Dd1s4S/BwS9BYwJw3+wIwV4mDVC:oC4V1Ihot5CFQjs4S/BwS9BmwJp9q1PK
                                                                                                                                                                                                                                            MD5:F0EF1B8EE3A22C3FA3CA4DD26012E309
                                                                                                                                                                                                                                            SHA1:4D78773275154677A5BB66D6393636CA2418EE69
                                                                                                                                                                                                                                            SHA-256:7D846678EC2A8C70F86308CF6BE585D760924C620DFCFB4B048F60D88577B69D
                                                                                                                                                                                                                                            SHA-512:7B230B6BE986E12C639DEE195198EE87FF1E9E0895FE3C101A3E8553D272986B9800C3C74B53A89128821D2D8D439A4968E48C29B2EDA43096E48F51B871B18C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef VER_H.#define VER_H..#ifdef __cplusplus.extern "C" {.#endif..#define VS_FILE_INFO RT_VERSION.#define VS_VERSION_INFO 1.#define VS_USER_DEFINED 100..#define VS_FFI_SIGNATURE 0xFEEF04BDL.#define VS_FFI_STRUCVERSION 0x00010000L.#define VS_FFI_FILEFLAGSMASK 0x0000003FL..#define VS_FF_DEBUG 0x00000001L.#define VS_FF_PRERELEASE 0x00000002L.#define VS_FF_PATCHED 0x00000004L.#define VS_FF_PRIVATEBUILD 0x00000008L.#define VS_FF_INFOINFERRED 0x00000010L.#define VS_FF_SPECIALBUILD 0x00000020L..#define VOS_UNKNOWN 0x00000000L.#define VOS_DOS 0x00010000L.#define VOS_OS216 0x00020000L.#define VOS_OS232 0x00030000L.#define VOS_NT 0x00040000L.#define VOS_WINCE 0x00050000L..#define VOS__BASE 0x00000000L.#define VOS__WINDOWS16 0x00000001L.#define VOS__PM16 0x00000002L.#define VOS__PM32

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-B7SCC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):193650
                                                                                                                                                                                                                                            Entropy (8bit):5.442692211038205
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:mgqyl7JPZPZWFLvC3b+tc55bLqkI66qJ+bOaCIzxlWLp9EhxveAMimiAg9+38w8l:FvgTAw+39O8+NQkK9t/k7IM
                                                                                                                                                                                                                                            MD5:39AB9E1D4A6B6871FC59D837A1910566
                                                                                                                                                                                                                                            SHA1:CEA4A15910A1DC02AF23A06ACE7B8B7BD6E1001D
                                                                                                                                                                                                                                            SHA-256:0881DEBBBD1879A08341E395FA1DCED6A7B1007A80A9C6ECC831A7800C90CA02
                                                                                                                                                                                                                                            SHA-512:652B8695DBBF04C76DB183435FDDC21034FD9C8C10CF648A21787855417B5050580C424C4DA773676BD6A6FD8C30596D905E3C9E91E946B37EA5723FBA9DF481
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINNT_.#define _WINNT_..#ifdef __cplusplus.extern "C" {.#endif..#include <ctype.h>.#define ANYSIZE_ARRAY 1..//gr #include <specstrings.h>..#define RESTRICTED_POINTER..#ifndef __CRT_UNALIGNED.#define __CRT_UNALIGNED.#endif..#if defined(__ia64__) || defined(__x86_64).#define UNALIGNED __CRT_UNALIGNED.#ifdef _WIN64.#define UNALIGNED64 __CRT_UNALIGNED.#else.#define UNALIGNED64.#endif.#else.#define UNALIGNED.#define UNALIGNED64.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && defined(__x86_64).#define _AMD64_.#endif..#if !defined(I_X86_) && !(defined(_X86_) && !defined(__x86_64)) && !defined(_AMD64_) && defined(__ia64__).#if

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-C72J0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14473
                                                                                                                                                                                                                                            Entropy (8bit):5.318184429302839
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:T3LK2osQDITqQWDVvRwPhOotRrwAIPmNLd1mBTVuRthEVPQKyybPki7wanag+4+M:lcio4tzIuhEVPQKyybrwan1+4+M
                                                                                                                                                                                                                                            MD5:A7EAC92053E54E029DC3B8356A49DF4A
                                                                                                                                                                                                                                            SHA1:475DF5425A60973CA79C1B0D5FA05DFD59E99E6A
                                                                                                                                                                                                                                            SHA-256:C965B8839E100E9AACAD333B373218F962A15840583231F968076441E781538B
                                                                                                                                                                                                                                            SHA-512:1A1F5032E2BA7A837FB043FC7B3DC15796B27FA481B2D8593F8012D503D1AAB5C82AB54404898FED81418FFC3B64712476DBC89ACAF92AACAC051FF40DD3F7CD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINCON_.#define _WINCON_..#ifdef __cplusplus.extern "C" {.#endif.. typedef struct _COORD {. SHORT X;. SHORT Y;. } COORD,*PCOORD;.. typedef struct _SMALL_RECT {. SHORT Left;. SHORT Top;. SHORT Right;. SHORT Bottom;. } SMALL_RECT,*PSMALL_RECT;.. typedef struct _KEY_EVENT_RECORD {. WINBOOL bKeyDown;. WORD wRepeatCount;. WORD wVirtualKeyCode;. WORD wVirtualScanCode;. union {. WCHAR UnicodeChar;. CHAR AsciiChar;. } uChar;. DWORD dwControlKeyState;. } KEY_EVENT_RECORD,*PKEY_EVENT_RECORD;..#define RIGHT_ALT_PRESSED 0x1.#define LEFT_ALT_PRESSED 0x2.#define RIGHT_CTRL_PRESSED 0x4.#define LEFT_CTRL_PRESSED 0x8.#define SHIFT_PRESSED 0x10.#define NUMLOCK_ON 0x20.#define SCROLLLOCK_ON 0x40.#define CAPSLOCK_ON 0x80.#define ENHA

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-HCTR0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):282
                                                                                                                                                                                                                                            Entropy (8bit):4.902277729484196
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cGtSy:UJJISFcShcFP+4BnWKiky
                                                                                                                                                                                                                                            MD5:584EBD620B89C671805EB5917278C46F
                                                                                                                                                                                                                                            SHA1:645DCA8A4775E323EED290EB1262A898E3BD8DF3
                                                                                                                                                                                                                                            SHA-256:81C951E1FB87AA8F6E8871A073277F1CD1CCB9B66F6EFA92AFF35BCD00A60726
                                                                                                                                                                                                                                            SHA-512:F80C37DF443967189B8B3E246E860E854A65283B9E7DBBFD87FE30E6E8285C785DF2D6F74AC9D7D59CDF655E543B830042A51574FEDCF5611714946DA2D1D542
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(pop).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-LTHHK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with very long lines (302)
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13963
                                                                                                                                                                                                                                            Entropy (8bit):5.433606364599901
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CVb+C+ikI8n1W8l12X3ufMfkebe+XxeceAUgnhicr7Df0ff8uc/1uA1uFZNz6deF:q+C3kI8n1W8l14VzPBAf
                                                                                                                                                                                                                                            MD5:0F0E5CB60E379839AC67467A6FD5280F
                                                                                                                                                                                                                                            SHA1:0783BEC9C6F621AEDD45D2F1010740D9A6152B0A
                                                                                                                                                                                                                                            SHA-256:6DBB969DC21E90D9044DABCD190268C1BB33E445862CE2A4A536E9A7134FA4EB
                                                                                                                                                                                                                                            SHA-512:06C87AE227BF6D9C00E8404C728CC77DE9840237647605AABF197A85131E4835FF6EE96D7BEE24FD7B423C86F64D673669D2D2E8061F03473B2B0A1E10DD8BCA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINREG_.#define _WINREG_..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#define RRF_RT_REG_NONE 0x00000001.#define RRF_RT_REG_SZ 0x00000002.#define RRF_RT_REG_EXPAND_SZ 0x00000004.#define RRF_RT_REG_BINARY 0x00000008.#define RRF_RT_REG_DWORD 0x00000010.#define RRF_RT_REG_MULTI_SZ 0x00000020.#define RRF_RT_REG_QWORD 0x00000040..#define RRF_RT_DWORD (RRF_RT_REG_BINARY | RRF_RT_REG_DWORD).#define RRF_RT_QWORD (RRF_RT_REG_BINARY | RRF_RT_REG_QWORD).#define RRF_RT_ANY 0x0000ffff..#define RRF_NOEXPAND 0x10000000.#define RRF_ZEROONFAILURE 0x20000000.. typedef ACCESS_MASK REGSAM;..#define HKEY_CLASSES_ROOT ((HKEY) (ULONG_PTR)((LONG)0x80000000)).#define HKEY_CURRENT_USER ((HKEY) (ULONG_PTR)((LONG)0x80000001)).#define HKEY_LOCAL_MACHINE (

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-MDU3L.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2173
                                                                                                                                                                                                                                            Entropy (8bit):5.14850892880743
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GAjzWlnWj5A0iB/s1bUys7sbUo7QJQj7RLbY:VjIWVAVB/s1Iys7sIo7QSjlvY
                                                                                                                                                                                                                                            MD5:437B745F448BA343620FEF2015B72E78
                                                                                                                                                                                                                                            SHA1:6E95B00A515154FAEDB95606F9AA429AFE40807E
                                                                                                                                                                                                                                            SHA-256:3B0D80E4B27E099C8AF543D6D9CCA295C68E115A0FBA7CD79CC0E76D1C3A5C11
                                                                                                                                                                                                                                            SHA-512:43EE580B0D94F5556A6D4227B103C52678CEECE4566A7CE3A9A494E8F19BCF3B33A3E765E10D62C53CC54552532C3B0B2828241354C4C14DF13CC7F90D6ED8AE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINDOWS_.#define _WINDOWS_..#ifndef WIN32_LEAN_AND_MEAN.#define WIN32_LEAN_AND_MEAN 1.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <_mingw.h>..#ifndef _INC_WINDOWS.#define _INC_WINDOWS..#if defined(RC_INVOKED) && !defined(NOWINRES)..#include <winresrc.h>.#else..#ifdef RC_INVOKED.#define NOATOM.#define NOGDI.#define NOGDICAPMASKS.#define NOMETAFILE.#define NOMINMAX.#define NOMSG.#define NOOPENFILE.#define NORASTEROPS.#define NOSCROLL.#define NOSOUND.#define NOSYSMETRICS.#define NOTEXTMETRIC.#define NOWH.#define NOCOMM.#define NOKANJI.#define NOCRYPT.#define NOMCX.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-ME631.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):179678
                                                                                                                                                                                                                                            Entropy (8bit):5.448601521160739
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:jgie2EUSlwrMbtENbSJGDN4tSUez2pUQkR:jgie7wrMSSJGDfUe++
                                                                                                                                                                                                                                            MD5:3243B7C1189CC2C02075C2B175592EA9
                                                                                                                                                                                                                                            SHA1:B520F45E195A50AB00ACC161EFEC7E6620E652AF
                                                                                                                                                                                                                                            SHA-256:4356BFCDF5209C4EC58DE486E2173CE4B17E0CE75A422B226FDDDD18597C9905
                                                                                                                                                                                                                                            SHA-512:CDAA9D91F80127028DC877924D2E41B4EF55714485536C4B64955195C94E8EBFBECF9A0D7545DF535CBF4C1977CA53C14379B96ABCEBF7AEC461BCBB87EF040E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINUSER_.#define _WINUSER_..#define WINUSERAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <stdarg.h>..#ifndef NOUSER. typedef HANDLE HDWP;. typedef VOID MENUTEMPLATEA;. typedef VOID MENUTEMPLATEW;. typedef PVOID LPMENUTEMPLATEA;. typedef PVOID LPMENUTEMPLATEW;..#ifdef UNICODE. typedef MENUTEMPLATEW MENUTEMPLATE;. typedef LPMENUTEMPLATEW LPMENUTEMPLATE;.#else. typedef MENUTEMPLATEA MENUTEMPLATE;. typedef LPMENUTEMPLATEA LPMENUTEMPLATE;.#endif.. typedef LRESULT (CALLBACK *WNDPROC)(HWND,UINT,WPARAM,LPARAM);. typedef INT_PTR (CALLBACK *DLGPROC)(HWND,UINT,WPARAM,LPARAM);. typedef VOID (CALLBACK *TIMERPROC)(HWND,UINT,UINT_PTR,DWORD);. typedef WINBOOL (CALLBACK *GRAYSTRINGPROC)(HDC,LPARAM,int);.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-NDQCS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.939467489498393
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3O2:UJJISFcShcFP+4BnWKi3O2
                                                                                                                                                                                                                                            MD5:F7CE406B57AF97C8BA95EEB9D7840C1D
                                                                                                                                                                                                                                            SHA1:ED211A37E0EFCA13A0146F9FE775875D32DB3496
                                                                                                                                                                                                                                            SHA-256:8EB67DD233D5A387D6DC1814CB6EB6C6DE9A123438FAEFCA7B442691CAF23049
                                                                                                                                                                                                                                            SHA-512:B7EE10FBFE60F4F6E998D48D88C36095DFA70524B9E24A6E3BDD6C0A62FBFCD66725E28F227DA1469448C909D08DC57ADD7484D7FEECA35B2FF3A4F526756256
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,1).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-R2FR8.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4165
                                                                                                                                                                                                                                            Entropy (8bit):5.37405161812663
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:lVeZAP1SQySDz25/rPjEgE+2VPYFjrQUnL:lVe01S9kNcH
                                                                                                                                                                                                                                            MD5:D65FFFB282C1F60CCBFC4DCF1410BE1F
                                                                                                                                                                                                                                            SHA1:2BE8BADB6C6FB0DB0B023BFBC7B6842E0AB73A8F
                                                                                                                                                                                                                                            SHA-256:7DB1B1FE46513F578A3C777C3CE300D8403D31FBFB6D00EACFF93286D2ED1293
                                                                                                                                                                                                                                            SHA-512:E7F9554980671DCB14C62FF462AE34961C01E0DD1AFA9F8E010370B0941E22BA619ABEA98DCE090762888A1E485586BAAA0917167FF6373C8309374EBCE8054F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef GUID_DEFINED.#define GUID_DEFINED.typedef struct _GUID {. unsigned long Data1;. unsigned short Data2;. unsigned short Data3;. unsigned char Data4[8 ];.} GUID;.#endif..#ifndef UUID_DEFINED.#define UUID_DEFINED.typedef GUID UUID;.#endif..#ifndef FAR.#define FAR.#endif..#ifndef DECLSPEC_SELECTANY.#define DECLSPEC_SELECTANY __declspec(selectany).#endif..#ifndef EXTERN_C.#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif.#endif..#ifdef DEFINE_GUID.#undef DEFINE_GUID.#endif..#ifdef INITGUID.#ifdef __cplusplus.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) EXTERN_C const GUID DECLSPEC_SELECTANY name = { l,w1,w2,{ b1,b2,b3,b4,b5,b6,b7,b8 } }.#else.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) const GUID DECLSPEC_SELEC

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-RVEM5.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):150512
                                                                                                                                                                                                                                            Entropy (8bit):5.042627381884036
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:fAOSurpB+BkRymeRfJOj/7AL1YxEilv+y2aUs/gtvyEmZ1m6tDLiSgF:RHu7LSqiQakytxtDa
                                                                                                                                                                                                                                            MD5:8A51F06DF0CB380EB7E944203BFEDE79
                                                                                                                                                                                                                                            SHA1:92B3F5D7EBBAA0F35F30F5FA68698D93A708B0B5
                                                                                                                                                                                                                                            SHA-256:590134000B1B5C4FB7AFBCC54A445A42228D74164A9E8B24434D1A993F76852E
                                                                                                                                                                                                                                            SHA-512:E50C7D2391C84B3F975F5E6E732691102595BBB857987AD0577B370C34D9C9C32DE3FEA64DC8DD45608320EB0E7455EE306CA50B1F19D4B209BFE1618EF9B22A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINERROR_.#define _WINERROR_..#define FACILITY_WINDOWSUPDATE 36.#define FACILITY_WINDOWS_CE 24.#define FACILITY_WINDOWS 8.#define FACILITY_URT 19.#define FACILITY_UMI 22.#define FACILITY_SXS 23.#define FACILITY_STORAGE 3.#define FACILITY_STATE_MANAGEMENT 34.#define FACILITY_SSPI 9.#define FACILITY_SCARD 16.#define FACILITY_SETUPAPI 15.#define FACILITY_SECURITY 9.#define FACILITY_RPC 1.#define FACILITY_WIN32 7.#define FACILITY_CONTROL 10.#define FACILITY_NULL 0.#define FACILITY_METADIRECTORY 35.#define FACILITY_MSMQ 14.#define FACILITY_MEDIASERVER 13.#define FACILITY_INTERNET 12.#define FACILITY_ITF 4.#define FACILITY_HTTP 25.#define FACILITY_DPLAY 21.#define FACILITY_DISPATCH 2.#define FACILITY_DIRECTORYSERVICE 37.#define FACILITY_CONFIGURATION 33.#define FACILITY_COM

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-S8QLD.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5674
                                                                                                                                                                                                                                            Entropy (8bit):5.253868357743171
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:l4nmx67GjIz13BkHelji9aF7e4KmCtnLK0kO5Ol60V:4mxbjYkHi+IM4OAO5gv
                                                                                                                                                                                                                                            MD5:4149CF07A0FCB5FAFAB7F58BCC951D8C
                                                                                                                                                                                                                                            SHA1:DBF6F1002B67DA30CE63BE5D41E0EAA76263AC9F
                                                                                                                                                                                                                                            SHA-256:137E9A43A136E4AE19B3A4C844023C6A1611B23685000364F6BE3143DB1A4C75
                                                                                                                                                                                                                                            SHA-512:1BC969D3700C3BEB6416EED13942142315EFEE5F929C55F539E11FB9196C8865CA05BE0A39094C6E7457B671BA33299D3861AEC6161DD0429E8A375F378659A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINDEF_.#define _WINDEF_..#ifndef STRICT.#define STRICT 1.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef BASETYPES.#define BASETYPES. typedef unsigned long ULONG;. typedef ULONG *PULONG;. typedef unsigned short USHORT;. typedef USHORT *PUSHORT;. typedef unsigned char UCHAR;. typedef UCHAR *PUCHAR;. typedef char *PSZ;.#endif..#define MAX_PATH 260..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#ifndef FALSE.#define FALSE 0.#endif..#ifndef TRUE.#define TRUE 1.#endif..#ifndef IN.#define IN.#endif..#ifndef OUT.#define OUT.#endif..#ifndef OPTIONAL.#define OPTIONAL.#endif..#undef far.#undef near.#undef pascal..#define far.#define near.#define pascal __stdcall..#define

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\is-VRBOM.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.939467489498393
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3uJuy:UJJISFcShcFP+4BnWKi3uV
                                                                                                                                                                                                                                            MD5:4FA6301A9105C4442FCD8181B17BF100
                                                                                                                                                                                                                                            SHA1:CD49157FA734AF5ECB57BDE0E7C57B9BC425CE98
                                                                                                                                                                                                                                            SHA-256:32FE7B5FF2387C916AD134EF5B5B0AC67447DA0E0DCCF405C31562AAC718D6D8
                                                                                                                                                                                                                                            SHA-512:EC6C5D061C788463D3E262E69ED74F5A21022007F4E3BC5DCDAA64ED641D0C4953A60A465E7972756E427E3B9AC71103AA36EF298F8E5D8FC946210152612599
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,8).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\poppack.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):282
                                                                                                                                                                                                                                            Entropy (8bit):4.902277729484196
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cGtSy:UJJISFcShcFP+4BnWKiky
                                                                                                                                                                                                                                            MD5:584EBD620B89C671805EB5917278C46F
                                                                                                                                                                                                                                            SHA1:645DCA8A4775E323EED290EB1262A898E3BD8DF3
                                                                                                                                                                                                                                            SHA-256:81C951E1FB87AA8F6E8871A073277F1CD1CCB9B66F6EFA92AFF35BCD00A60726
                                                                                                                                                                                                                                            SHA-512:F80C37DF443967189B8B3E246E860E854A65283B9E7DBBFD87FE30E6E8285C785DF2D6F74AC9D7D59CDF655E543B830042A51574FEDCF5611714946DA2D1D542
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(pop).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack1.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.939467489498393
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3O2:UJJISFcShcFP+4BnWKi3O2
                                                                                                                                                                                                                                            MD5:F7CE406B57AF97C8BA95EEB9D7840C1D
                                                                                                                                                                                                                                            SHA1:ED211A37E0EFCA13A0146F9FE775875D32DB3496
                                                                                                                                                                                                                                            SHA-256:8EB67DD233D5A387D6DC1814CB6EB6C6DE9A123438FAEFCA7B442691CAF23049
                                                                                                                                                                                                                                            SHA-512:B7EE10FBFE60F4F6E998D48D88C36095DFA70524B9E24A6E3BDD6C0A62FBFCD66725E28F227DA1469448C909D08DC57ADD7484D7FEECA35B2FF3A4F526756256
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,1).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack2.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.939467489498393
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3kJuy:UJJISFcShcFP+4BnWKi3suy
                                                                                                                                                                                                                                            MD5:5F9BA2A3122F6963219BDD95EFF0D63B
                                                                                                                                                                                                                                            SHA1:FC7EF1DBF2D51D9E38E79BC4D2DFE7F89107263E
                                                                                                                                                                                                                                            SHA-256:D459CBD546929FD44980D32C1680A8F176D717CE9DF162F5C5C443DFDCCC9E42
                                                                                                                                                                                                                                            SHA-512:4339E932DA337FC33CB8544FAD3065F82F689E17AE9CFD6A3035A0A1C62271ED0EFC44553A75C29207E97555E55FF8F76D42FBEF57B46B0E117B087A367A5D1F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,2).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack4.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.932449945638745
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3iV:UJJISFcShcFP+4BnWKi3iV
                                                                                                                                                                                                                                            MD5:9E2E16A461B193BAE9E69C59C9A3E040
                                                                                                                                                                                                                                            SHA1:17AAA9161D3F9D7270EDB80BC850B3AD1CD9151A
                                                                                                                                                                                                                                            SHA-256:CD3BA1258A5DD9C714879D3E499B021C85EE9827C06BAC2FC2C1E677B5909531
                                                                                                                                                                                                                                            SHA-512:37C580B406EB30FC66B0135D91D8DC743A9F2ABBF830A58272ECF910E4F4BDE10ED9A1CF07A8C0F24BFA2D8E86883AF76C5A7805FC70A2AE69F1A9D8225774DF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,4).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack8.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):285
                                                                                                                                                                                                                                            Entropy (8bit):4.939467489498393
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3uJuy:UJJISFcShcFP+4BnWKi3uV
                                                                                                                                                                                                                                            MD5:4FA6301A9105C4442FCD8181B17BF100
                                                                                                                                                                                                                                            SHA1:CD49157FA734AF5ECB57BDE0E7C57B9BC425CE98
                                                                                                                                                                                                                                            SHA-256:32FE7B5FF2387C916AD134EF5B5B0AC67447DA0E0DCCF405C31562AAC718D6D8
                                                                                                                                                                                                                                            SHA-512:EC6C5D061C788463D3E262E69ED74F5A21022007F4E3BC5DCDAA64ED641D0C4953A60A465E7972756E427E3B9AC71103AA36EF298F8E5D8FC946210152612599
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) || defined(RC_INVOKED)).#pragma pack(push,8).#endif.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\winbase.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):159607
                                                                                                                                                                                                                                            Entropy (8bit):5.448523174174419
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:p8iWoUKAVEvTQ/BUNRB+NNKjxyfmTcFqTPj:p8iWoUKAVEvTQmcFqTPj
                                                                                                                                                                                                                                            MD5:18908ACE3445091E5966CC99F9D4B5B9
                                                                                                                                                                                                                                            SHA1:130D1CFA2D8A8A17FA2AFA4DDF4FE3DFBA4542D5
                                                                                                                                                                                                                                            SHA-256:47EFFBA4D4BB7DFBE373F1156285A170042FE1A3552BCBBEE460E5DB68E1FF2D
                                                                                                                                                                                                                                            SHA-512:0E63D752B56051057C4E553307A708C2359EAC58EA96EA0077931642482EB8B6E0B28984A278663D85C6B1739564CAB6FFED3D9582306473841A355BD0CBEE61
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINBASE_.#define _WINBASE_..#define WINADVAPI DECLSPEC_IMPORT.#define WINBASEAPI DECLSPEC_IMPORT.#define ZAWPROXYAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#define DefineHandleTable(w) ((w),TRUE).#define LimitEmsPages(dw).#define SetSwapAreaSize(w) (w).#define LockSegment(w) GlobalFix((HANDLE)(w)).#define UnlockSegment(w) GlobalUnfix((HANDLE)(w)).#define GetCurrentTime() GetTickCount()..#define Yield()..#define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1).#define INVALID_FILE_SIZE ((DWORD)0xffffffff).#define INVALID_SET_FILE_POINTER ((DWORD)-1).#define INVALID_FILE_ATTRIBUTES ((DWORD)-1)..#define FILE_BEGIN 0.#define FILE_CURRENT 1.#define FILE_END 2..#define TIME_ZONE_ID_INVALID ((DWORD)0xffffffff)..#define WAIT_FAILED ((DWORD)0xffffffff).#define WAI

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\wincon.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14473
                                                                                                                                                                                                                                            Entropy (8bit):5.318184429302839
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:T3LK2osQDITqQWDVvRwPhOotRrwAIPmNLd1mBTVuRthEVPQKyybPki7wanag+4+M:lcio4tzIuhEVPQKyybrwan1+4+M
                                                                                                                                                                                                                                            MD5:A7EAC92053E54E029DC3B8356A49DF4A
                                                                                                                                                                                                                                            SHA1:475DF5425A60973CA79C1B0D5FA05DFD59E99E6A
                                                                                                                                                                                                                                            SHA-256:C965B8839E100E9AACAD333B373218F962A15840583231F968076441E781538B
                                                                                                                                                                                                                                            SHA-512:1A1F5032E2BA7A837FB043FC7B3DC15796B27FA481B2D8593F8012D503D1AAB5C82AB54404898FED81418FFC3B64712476DBC89ACAF92AACAC051FF40DD3F7CD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINCON_.#define _WINCON_..#ifdef __cplusplus.extern "C" {.#endif.. typedef struct _COORD {. SHORT X;. SHORT Y;. } COORD,*PCOORD;.. typedef struct _SMALL_RECT {. SHORT Left;. SHORT Top;. SHORT Right;. SHORT Bottom;. } SMALL_RECT,*PSMALL_RECT;.. typedef struct _KEY_EVENT_RECORD {. WINBOOL bKeyDown;. WORD wRepeatCount;. WORD wVirtualKeyCode;. WORD wVirtualScanCode;. union {. WCHAR UnicodeChar;. CHAR AsciiChar;. } uChar;. DWORD dwControlKeyState;. } KEY_EVENT_RECORD,*PKEY_EVENT_RECORD;..#define RIGHT_ALT_PRESSED 0x1.#define LEFT_ALT_PRESSED 0x2.#define RIGHT_CTRL_PRESSED 0x4.#define LEFT_CTRL_PRESSED 0x8.#define SHIFT_PRESSED 0x10.#define NUMLOCK_ON 0x20.#define SCROLLLOCK_ON 0x40.#define CAPSLOCK_ON 0x80.#define ENHA

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\windef.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5674
                                                                                                                                                                                                                                            Entropy (8bit):5.253868357743171
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:l4nmx67GjIz13BkHelji9aF7e4KmCtnLK0kO5Ol60V:4mxbjYkHi+IM4OAO5gv
                                                                                                                                                                                                                                            MD5:4149CF07A0FCB5FAFAB7F58BCC951D8C
                                                                                                                                                                                                                                            SHA1:DBF6F1002B67DA30CE63BE5D41E0EAA76263AC9F
                                                                                                                                                                                                                                            SHA-256:137E9A43A136E4AE19B3A4C844023C6A1611B23685000364F6BE3143DB1A4C75
                                                                                                                                                                                                                                            SHA-512:1BC969D3700C3BEB6416EED13942142315EFEE5F929C55F539E11FB9196C8865CA05BE0A39094C6E7457B671BA33299D3861AEC6161DD0429E8A375F378659A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINDEF_.#define _WINDEF_..#ifndef STRICT.#define STRICT 1.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef BASETYPES.#define BASETYPES. typedef unsigned long ULONG;. typedef ULONG *PULONG;. typedef unsigned short USHORT;. typedef USHORT *PUSHORT;. typedef unsigned char UCHAR;. typedef UCHAR *PUCHAR;. typedef char *PSZ;.#endif..#define MAX_PATH 260..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void *)0).#endif.#endif..#ifndef FALSE.#define FALSE 0.#endif..#ifndef TRUE.#define TRUE 1.#endif..#ifndef IN.#define IN.#endif..#ifndef OUT.#define OUT.#endif..#ifndef OPTIONAL.#define OPTIONAL.#endif..#undef far.#undef near.#undef pascal..#define far.#define near.#define pascal __stdcall..#define

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\windows.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2173
                                                                                                                                                                                                                                            Entropy (8bit):5.14850892880743
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:GAjzWlnWj5A0iB/s1bUys7sbUo7QJQj7RLbY:VjIWVAVB/s1Iys7sIo7QSjlvY
                                                                                                                                                                                                                                            MD5:437B745F448BA343620FEF2015B72E78
                                                                                                                                                                                                                                            SHA1:6E95B00A515154FAEDB95606F9AA429AFE40807E
                                                                                                                                                                                                                                            SHA-256:3B0D80E4B27E099C8AF543D6D9CCA295C68E115A0FBA7CD79CC0E76D1C3A5C11
                                                                                                                                                                                                                                            SHA-512:43EE580B0D94F5556A6D4227B103C52678CEECE4566A7CE3A9A494E8F19BCF3B33A3E765E10D62C53CC54552532C3B0B2828241354C4C14DF13CC7F90D6ED8AE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINDOWS_.#define _WINDOWS_..#ifndef WIN32_LEAN_AND_MEAN.#define WIN32_LEAN_AND_MEAN 1.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <_mingw.h>..#ifndef _INC_WINDOWS.#define _INC_WINDOWS..#if defined(RC_INVOKED) && !defined(NOWINRES)..#include <winresrc.h>.#else..#ifdef RC_INVOKED.#define NOATOM.#define NOGDI.#define NOGDICAPMASKS.#define NOMETAFILE.#define NOMINMAX.#define NOMSG.#define NOOPENFILE.#define NORASTEROPS.#define NOSCROLL.#define NOSOUND.#define NOSYSMETRICS.#define NOTEXTMETRIC.#define NOWH.#define NOCOMM.#define NOKANJI.#define NOCRYPT.#define NOMCX.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\winerror.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):150512
                                                                                                                                                                                                                                            Entropy (8bit):5.042627381884036
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:fAOSurpB+BkRymeRfJOj/7AL1YxEilv+y2aUs/gtvyEmZ1m6tDLiSgF:RHu7LSqiQakytxtDa
                                                                                                                                                                                                                                            MD5:8A51F06DF0CB380EB7E944203BFEDE79
                                                                                                                                                                                                                                            SHA1:92B3F5D7EBBAA0F35F30F5FA68698D93A708B0B5
                                                                                                                                                                                                                                            SHA-256:590134000B1B5C4FB7AFBCC54A445A42228D74164A9E8B24434D1A993F76852E
                                                                                                                                                                                                                                            SHA-512:E50C7D2391C84B3F975F5E6E732691102595BBB857987AD0577B370C34D9C9C32DE3FEA64DC8DD45608320EB0E7455EE306CA50B1F19D4B209BFE1618EF9B22A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINERROR_.#define _WINERROR_..#define FACILITY_WINDOWSUPDATE 36.#define FACILITY_WINDOWS_CE 24.#define FACILITY_WINDOWS 8.#define FACILITY_URT 19.#define FACILITY_UMI 22.#define FACILITY_SXS 23.#define FACILITY_STORAGE 3.#define FACILITY_STATE_MANAGEMENT 34.#define FACILITY_SSPI 9.#define FACILITY_SCARD 16.#define FACILITY_SETUPAPI 15.#define FACILITY_SECURITY 9.#define FACILITY_RPC 1.#define FACILITY_WIN32 7.#define FACILITY_CONTROL 10.#define FACILITY_NULL 0.#define FACILITY_METADIRECTORY 35.#define FACILITY_MSMQ 14.#define FACILITY_MEDIASERVER 13.#define FACILITY_INTERNET 12.#define FACILITY_ITF 4.#define FACILITY_HTTP 25.#define FACILITY_DPLAY 21.#define FACILITY_DISPATCH 2.#define FACILITY_DIRECTORYSERVICE 37.#define FACILITY_CONFIGURATION 33.#define FACILITY_COM

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\wingdi.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):121301
                                                                                                                                                                                                                                            Entropy (8bit):5.419416589760816
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:mmN0oz+ODr15Ye92/rvZVXkRs4pItxtv7OosWBkEwJaYygZtk+tUtwtmtDlwsigp:nuPn7z57mW7T1QFYLCOdKSbuo8Sl
                                                                                                                                                                                                                                            MD5:FD80383F6F92379E074379BA54D68BDC
                                                                                                                                                                                                                                            SHA1:0A4D4926DF853E126FCC52150C84822AF1EF8035
                                                                                                                                                                                                                                            SHA-256:DF5937AC1805B27ABBA03277D2C34CAEE8CB4387EDB894ADCD73E6172A9FBD94
                                                                                                                                                                                                                                            SHA-512:4ED6C5508C77A8A3272835C6AE1323514E42D015F3CB53168382FFD78FB1A73D806AF5421378D1430ED344BA1200E3006D5AAF4150E925C1F2267A8D637A50A4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINGDI_.#define _WINGDI_..#define WINGDIAPI DECLSPEC_IMPORT.#define WINSPOOLAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef NOGDI.#ifndef NORASTEROPS.#define R2_BLACK 1.#define R2_NOTMERGEPEN 2.#define R2_MASKNOTPEN 3.#define R2_NOTCOPYPEN 4.#define R2_MASKPENNOT 5.#define R2_NOT 6.#define R2_XORPEN 7.#define R2_NOTMASKPEN 8.#define R2_MASKPEN 9.#define R2_NOTXORPEN 10.#define R2_NOP 11.#define R2_MERGENOTPEN 12.#define R2_COPYPEN 13.#define R2_MERGEPENNOT 14.#define R2_MERGEPEN 15.#define R2_WHITE 16.#define R2_LAST 16..#define SRCCOPY (DWORD)0x00CC0020.#define SRCPAINT (DWORD)0x00EE0086.#define SRCAND (DWORD)0x008800C6.#define SRCINVERT (DWORD)0x00660046.#define SRCERASE (DWORD)0x00440328.#define NOTS

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\winnt.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):193650
                                                                                                                                                                                                                                            Entropy (8bit):5.442692211038205
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:mgqyl7JPZPZWFLvC3b+tc55bLqkI66qJ+bOaCIzxlWLp9EhxveAMimiAg9+38w8l:FvgTAw+39O8+NQkK9t/k7IM
                                                                                                                                                                                                                                            MD5:39AB9E1D4A6B6871FC59D837A1910566
                                                                                                                                                                                                                                            SHA1:CEA4A15910A1DC02AF23A06ACE7B8B7BD6E1001D
                                                                                                                                                                                                                                            SHA-256:0881DEBBBD1879A08341E395FA1DCED6A7B1007A80A9C6ECC831A7800C90CA02
                                                                                                                                                                                                                                            SHA-512:652B8695DBBF04C76DB183435FDDC21034FD9C8C10CF648A21787855417B5050580C424C4DA773676BD6A6FD8C30596D905E3C9E91E946B37EA5723FBA9DF481
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINNT_.#define _WINNT_..#ifdef __cplusplus.extern "C" {.#endif..#include <ctype.h>.#define ANYSIZE_ARRAY 1..//gr #include <specstrings.h>..#define RESTRICTED_POINTER..#ifndef __CRT_UNALIGNED.#define __CRT_UNALIGNED.#endif..#if defined(__ia64__) || defined(__x86_64).#define UNALIGNED __CRT_UNALIGNED.#ifdef _WIN64.#define UNALIGNED64 __CRT_UNALIGNED.#else.#define UNALIGNED64.#endif.#else.#define UNALIGNED.#define UNALIGNED64.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && defined(__x86_64).#define _AMD64_.#endif..#if !defined(I_X86_) && !(defined(_X86_) && !defined(__x86_64)) && !defined(_AMD64_) && defined(__ia64__).#if

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\winreg.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with very long lines (302)
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13963
                                                                                                                                                                                                                                            Entropy (8bit):5.433606364599901
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:CVb+C+ikI8n1W8l12X3ufMfkebe+XxeceAUgnhicr7Df0ff8uc/1uA1uFZNz6deF:q+C3kI8n1W8l14VzPBAf
                                                                                                                                                                                                                                            MD5:0F0E5CB60E379839AC67467A6FD5280F
                                                                                                                                                                                                                                            SHA1:0783BEC9C6F621AEDD45D2F1010740D9A6152B0A
                                                                                                                                                                                                                                            SHA-256:6DBB969DC21E90D9044DABCD190268C1BB33E445862CE2A4A536E9A7134FA4EB
                                                                                                                                                                                                                                            SHA-512:06C87AE227BF6D9C00E8404C728CC77DE9840237647605AABF197A85131E4835FF6EE96D7BEE24FD7B423C86F64D673669D2D2E8061F03473B2B0A1E10DD8BCA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINREG_.#define _WINREG_..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#define RRF_RT_REG_NONE 0x00000001.#define RRF_RT_REG_SZ 0x00000002.#define RRF_RT_REG_EXPAND_SZ 0x00000004.#define RRF_RT_REG_BINARY 0x00000008.#define RRF_RT_REG_DWORD 0x00000010.#define RRF_RT_REG_MULTI_SZ 0x00000020.#define RRF_RT_REG_QWORD 0x00000040..#define RRF_RT_DWORD (RRF_RT_REG_BINARY | RRF_RT_REG_DWORD).#define RRF_RT_QWORD (RRF_RT_REG_BINARY | RRF_RT_REG_QWORD).#define RRF_RT_ANY 0x0000ffff..#define RRF_NOEXPAND 0x10000000.#define RRF_ZEROONFAILURE 0x20000000.. typedef ACCESS_MASK REGSAM;..#define HKEY_CLASSES_ROOT ((HKEY) (ULONG_PTR)((LONG)0x80000000)).#define HKEY_CURRENT_USER ((HKEY) (ULONG_PTR)((LONG)0x80000001)).#define HKEY_LOCAL_MACHINE (

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\winuser.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):179678
                                                                                                                                                                                                                                            Entropy (8bit):5.448601521160739
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:jgie2EUSlwrMbtENbSJGDN4tSUez2pUQkR:jgie7wrMSSJGDfUe++
                                                                                                                                                                                                                                            MD5:3243B7C1189CC2C02075C2B175592EA9
                                                                                                                                                                                                                                            SHA1:B520F45E195A50AB00ACC161EFEC7E6620E652AF
                                                                                                                                                                                                                                            SHA-256:4356BFCDF5209C4EC58DE486E2173CE4B17E0CE75A422B226FDDDD18597C9905
                                                                                                                                                                                                                                            SHA-512:CDAA9D91F80127028DC877924D2E41B4EF55714485536C4B64955195C94E8EBFBECF9A0D7545DF535CBF4C1977CA53C14379B96ABCEBF7AEC461BCBB87EF040E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINUSER_.#define _WINUSER_..#define WINUSERAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <stdarg.h>..#ifndef NOUSER. typedef HANDLE HDWP;. typedef VOID MENUTEMPLATEA;. typedef VOID MENUTEMPLATEW;. typedef PVOID LPMENUTEMPLATEA;. typedef PVOID LPMENUTEMPLATEW;..#ifdef UNICODE. typedef MENUTEMPLATEW MENUTEMPLATE;. typedef LPMENUTEMPLATEW LPMENUTEMPLATE;.#else. typedef MENUTEMPLATEA MENUTEMPLATE;. typedef LPMENUTEMPLATEA LPMENUTEMPLATE;.#endif.. typedef LRESULT (CALLBACK *WNDPROC)(HWND,UINT,WPARAM,LPARAM);. typedef INT_PTR (CALLBACK *DLGPROC)(HWND,UINT,WPARAM,LPARAM);. typedef VOID (CALLBACK *TIMERPROC)(HWND,UINT,UINT_PTR,DWORD);. typedef WINBOOL (CALLBACK *GRAYSTRINGPROC)(HDC,LPARAM,int);.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\include\winapi\winver.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5381
                                                                                                                                                                                                                                            Entropy (8bit):5.237607493279814
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:EtGsCwPV1Ihot5C5snyv5vdQSZWVvc22c26T9Dd1s4S/BwS9BYwJw3+wIwV4mDVC:oC4V1Ihot5CFQjs4S/BwS9BmwJp9q1PK
                                                                                                                                                                                                                                            MD5:F0EF1B8EE3A22C3FA3CA4DD26012E309
                                                                                                                                                                                                                                            SHA1:4D78773275154677A5BB66D6393636CA2418EE69
                                                                                                                                                                                                                                            SHA-256:7D846678EC2A8C70F86308CF6BE585D760924C620DFCFB4B048F60D88577B69D
                                                                                                                                                                                                                                            SHA-512:7B230B6BE986E12C639DEE195198EE87FF1E9E0895FE3C101A3E8553D272986B9800C3C74B53A89128821D2D8D439A4968E48C29B2EDA43096E48F51B871B18C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/**. * This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef VER_H.#define VER_H..#ifdef __cplusplus.extern "C" {.#endif..#define VS_FILE_INFO RT_VERSION.#define VS_VERSION_INFO 1.#define VS_USER_DEFINED 100..#define VS_FFI_SIGNATURE 0xFEEF04BDL.#define VS_FFI_STRUCVERSION 0x00010000L.#define VS_FFI_FILEFLAGSMASK 0x0000003FL..#define VS_FF_DEBUG 0x00000001L.#define VS_FF_PRERELEASE 0x00000002L.#define VS_FF_PATCHED 0x00000004L.#define VS_FF_PRIVATEBUILD 0x00000008L.#define VS_FF_INFOINFERRED 0x00000010L.#define VS_FF_SPECIALBUILD 0x00000020L..#define VOS_UNKNOWN 0x00000000L.#define VOS_DOS 0x00010000L.#define VOS_OS216 0x00020000L.#define VOS_OS232 0x00030000L.#define VOS_NT 0x00040000L.#define VOS_WINCE 0x00050000L..#define VOS__BASE 0x00000000L.#define VOS__WINDOWS16 0x00000001L.#define VOS__PM16 0x00000002L.#define VOS__PM32

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-0G0TM.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):399264
                                                                                                                                                                                                                                            Entropy (8bit):6.025523802176381
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:G0N02KsbnIU70vYrRHAjC0Y0glwgugEnoSE5jq:U2tIUYArRv0Y0glwgugEnoSE5jq
                                                                                                                                                                                                                                            MD5:F921416197C2AE407D53BA5712C3930A
                                                                                                                                                                                                                                            SHA1:6A7DAA7372E93C48758B9752C8A5A673B525632B
                                                                                                                                                                                                                                            SHA-256:E31B233DDF070798CC0381CC6285F6F79EA0C17B99737F7547618DCFD36CDC0E
                                                                                                                                                                                                                                            SHA-512:0139EFB76C2107D0497BE9910836D7C19329E4399AA8D46BBE17AE63D56AB73004C51B650CE38D79681C22C2D1B77078A7D7185431882BAF3E7BEF473AC95DCE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.......................P....)...-................@.......................... ..................................................d........................k..................................P.......................0................................text...P........................... ..`.data....).......*..................@....rdata.............................@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-1DA6M.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):339864
                                                                                                                                                                                                                                            Entropy (8bit):6.56829741282491
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:ZnVdQfxRaiC76I/wZGteu+WJrXeN6joNtMrvMl9u61s1JGTBHpMqdmgIIE5pY2B:jdsxs6I6k9MUoNt2vSs8KqdmgIIE/b
                                                                                                                                                                                                                                            MD5:A358DAE60F1C0F6A633F98B1E4D3E850
                                                                                                                                                                                                                                            SHA1:2016F1FB0F8000E515602498432951B7C5BC5ACA
                                                                                                                                                                                                                                            SHA-256:25C648CFDB4CDBBB13630ADC7C14F2BB556C98F5CD1DCBECAFFA91629D2D4A4C
                                                                                                                                                                                                                                            SHA-512:879B5E95CF7F06E105930724BBC6967B367417DCE390A15DE48BF5CE76CE2435EA4A59095AB67EEE5A05FA41126DDB984C2154ABA34B33FAC895A1CCC2D2A617
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.j...9...9...9..p9...9..V9...9..W9...9..h9...9K.|9...9...9...9#.S9...9#.k9...9.|l9...9#.i9...9Rich...9........PE..d...t.&V.........." .........J...............................................0............`..........................................h.......t..d...............\+.......g... ......@...8............................8..p............................................text............................... ..`.rdata..P...........................@..@.data....R......."...n..............@....pdata..\+.......,..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-24I47.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):262552
                                                                                                                                                                                                                                            Entropy (8bit):6.029187209935358
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:JViiO5Ea9m3XJusq4opSm7Im9SC2w/iKhF58jfq65bgusSVIRZOl0vDoD4CfOMsj:JVZcWJusRPm7kCdKfkkApZt
                                                                                                                                                                                                                                            MD5:19B2050B660A4F9FCB71C93853F2E79C
                                                                                                                                                                                                                                            SHA1:5FFA886FA019FCD20008E8820A0939C09A62407A
                                                                                                                                                                                                                                            SHA-256:5421B570FBC1165D7794C08279E311672DC4F42CB7AE1CBDDCD7EEA0B1136FFF
                                                                                                                                                                                                                                            SHA-512:A93E47387AB0D327B71C3045B3964C7586D0E03DDDB2E692F6671FB99659E829591D5F23CE7A95683D82D239BA7D11FB5A123834629A53DE5CE5DBA6AA714A9A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...G O......h...`...............................................J^..................................................@.......P............`...-.......g..........................................................P................................text... O.......P.................. ..`.data........`.......T..............@....rdata..l............n..............@..@.pdata...-...`.......F..............@..@.bss....h................................CRT.................t..............@....idata...............v..............@....edata..@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-298KH.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):332704
                                                                                                                                                                                                                                            Entropy (8bit):6.512223997122371
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:UokW02RSGoOZQcW2jS95cM0EsZjv8trtH3Vizwy:ZkW02RsOKcWnDdMv8trtX0
                                                                                                                                                                                                                                            MD5:E9B5905D495A88ADBC12C811785E72EC
                                                                                                                                                                                                                                            SHA1:CA0546646986AAB770C7CF2E723C736777802880
                                                                                                                                                                                                                                            SHA-256:3EB9CD27035D4193E32E271778643F3ACB2BA73341D87FD8BB18D99AF3DFFDEA
                                                                                                                                                                                                                                            SHA-512:4124180B118149C25F8EA8DBBB2912B4BD56B43F695BF0FF9C6CCC95ADE388F1BE7D440A791D49E4D5C9C350EA113CF65F839A3C47D705533716ACC53DD038F8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........D(..$-..................................................P...........................................d........................k.......:..................................................P................................text............................... ..`.data...D(.......*..................@....rdata..............................@..@.bss....$-...p...........................CRT.................Z..............@....idata...............\..............@....edata...............j..............@..@.reloc...:.......<...l..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-2GQ07.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (520), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):215333
                                                                                                                                                                                                                                            Entropy (8bit):4.786182096058482
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:VcIxsXTXvMeRTWJANaOOwubWiSe65oCmL/+5y/McvJVNry++Ctso2NwVWy+cOcEV:JLSRgun
                                                                                                                                                                                                                                            MD5:924416232DF99AEF96A2D9E8125AFE78
                                                                                                                                                                                                                                            SHA1:7F29A338CEFA00BE5FCDC8B94C41FFC31EE625B9
                                                                                                                                                                                                                                            SHA-256:77C6D324F03A8429BCE858824CFFFCFB7A50D39616D2F9D2729910E086F5AD9A
                                                                                                                                                                                                                                            SHA-512:470C55E302C86353584EEABB3510B4EFF6353ED16F549DB7C155B2C8283216F2B413D77C9FE20A12F6F55A07C9BE24614DF3A8F5B2CABF1597010249239D63F5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:List of CE specific functions and variables:....Global Variables:..TrainerOrigin : A variable that contains the path of the trainer that launched cheat engine (Only set when launched as a trainer)..process : A variable that contains the main modulename of the currently opened process..MainForm: The main ce gui..AddressList: The address list of the main ce gui......Global Functions:..getCEVersion(): Returns a floating point value specifying the version of cheat engine..getCheatEngineFileVersion(): Returns the full version data of the cheat engine version. A raw integer, and a table containing major, minor, release and build....getOperatingSystem(): Returns 0 if CE is running in Windows, 1 for Mac....darkMode(): Returns true if CE is running in windows Dark Mode. Has no effect on mac....activateProtection(): Prevents basic memory scanners from opening the cheat engine process (Not that useful)..enableDRM(altitude OPTIONAL, secondaryprocessid OPTIONAL ) : Prevents normal memory scanners f

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-2JPQC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):104
                                                                                                                                                                                                                                            Entropy (8bit):4.292808527787486
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:VSPAiQ7UeSaClo+tHEu3jdXgOYsO:Vr7Ueyl4u3jdQOS
                                                                                                                                                                                                                                            MD5:A2E60A2F01F69D0DA415C58F25C37E5B
                                                                                                                                                                                                                                            SHA1:FA1A0D6183FEE10DE5FA4C554370556217E3AF26
                                                                                                                                                                                                                                            SHA-256:DC9354CCF9667D1E5CA13D6468BA2C258256042D7C25E6D91ADE7F8E2A2FF3BF
                                                                                                                                                                                                                                            SHA-512:CE7F5F8365D2EF3DA14D4123CC7EF053A7F99E8F98D47E6C5967F267B8EC7FDAC2DA993D0FC26DF8EB2FACE176BA56B7359BA1F29F021E1DFDD561B15EFE64AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#Enter modulenames you do not wish to trace..#kernel32.dll #example. comment out to ignore kernel32.dll

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-2RDUM.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16708024
                                                                                                                                                                                                                                            Entropy (8bit):6.11289505731243
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:H/KthjnNWKtC5bqOrXSFjmnIQGQCW/4PRtYRN3Ticx8cP:fKthjnNWKtC5bqOrXSjmnxGQaTdy8c
                                                                                                                                                                                                                                            MD5:910DE25BD63B5DA521FC0B598920C4EC
                                                                                                                                                                                                                                            SHA1:94A15930AAF99F12B349BE80924857673CDC8566
                                                                                                                                                                                                                                            SHA-256:8CAEF5000B57BCA014EF33E962DF4FCA21AEAD0664892724674619EF732440AD
                                                                                                                                                                                                                                            SHA-512:6FF910BB4912FEA1FA8FD91E47AE6348C8BF2EFF4F2F5F9EF646A775CA1ECFEF02C23F81BAF6FE2D0B0BDDA7617D91DF52E75DC6063E86EA0444B0538CBD4E6C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{.....@....=........@......................................!.......................................................P...............p..L........k..................................p.{.(....................i..H............................text.....{.......{................. ..`.data.........{.......{.............@....rdata...qa......ra................@..@.pdata..L....p.......F..............@..@.bss....@....0...........................CRT.........@......................@....idata...b...P...d..................@....rsrc............ ...d..............@.../4......(...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-3265L.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):242616
                                                                                                                                                                                                                                            Entropy (8bit):6.432754517349666
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Bj9mOBuELLZXBJPCR6ygny56rs+iO2AwCNCtALb44TPk3Ap1rleY/DptNH/P0uHV:fn7LhBJ9W56A+iOlfN/LbZnbptN0uZH
                                                                                                                                                                                                                                            MD5:9AF96706762298CF72DF2A74213494C9
                                                                                                                                                                                                                                            SHA1:4B5FD2F168380919524ECCE77AA1BE330FDEF57A
                                                                                                                                                                                                                                            SHA-256:65FA2CCB3AC5400DD92DDA5F640445A6E195DA7C827107260F67624D3EB95E7D
                                                                                                                                                                                                                                            SHA-512:29A0619093C4C0ECF602C861EC819EF16550C0607DF93067EAEF4259A84FD7D40EB88CD5548C0B3B265F3CE5237B585F508FDD543FA281737BE17C0551163BD4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........H..................$...t.................@.............................................................................d....................H...k..................................P.......................4................................text............................... ..`.data...$...........................@....rdata..............................@..@.bss....t....P...........................CRT.................,..............@....idata..............................@....rsrc................:..............@.../4......$............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-3C6G0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.593562490537789
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:O18qyj/0fZMX/ferOk9OWtW2kdT0PgluBKd9cCkAl8F:O10/3er/X1Y4BKtJuF
                                                                                                                                                                                                                                            MD5:A4B42FDCA7043792CCC37C611DB21075
                                                                                                                                                                                                                                            SHA1:17CBF2EC6ECA6BD0CAF1DA78AF51D9F363151168
                                                                                                                                                                                                                                            SHA-256:8B8955524079508FEC59D396A891110660AE2486F24BC8BCBCDBCC975BB49AE7
                                                                                                                                                                                                                                            SHA-512:B6877F5B5B88A9B05A85F562D975A8820ACAC3773AA5FB91CEB1DA6C731C90C486A6AAF78DF6EDCF69B0EA74286DC7CC8FA2CBF98453539EFA55EC18D38116BB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...[0n...w+$.H'1,..t...).=s..Ds.......y....G2......wX+...W=............./X1AjF~G4...OD>....J.R."..S......0.Q[8....A..6.... ...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-3D3CV.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3403192
                                                                                                                                                                                                                                            Entropy (8bit):6.035185815441339
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:ar2V9BrWblVbqS1+Cxz0MB95D//ocnaMo6WuDgRPZO/Y12y6Pu:aqV9BqzbqSR009StqG
                                                                                                                                                                                                                                            MD5:1C1630B241D5A6BE07BFBA2B3EA97A25
                                                                                                                                                                                                                                            SHA1:7203255D1A6021874D41A48FCD5719FD7034F34C
                                                                                                                                                                                                                                            SHA-256:526CDDD0D843F5984AC6CB98D28F22B090682C3A8704122B644EC8AE2C9A10E5
                                                                                                                                                                                                                                            SHA-512:BDDEDB575FEBF8C8103CFBB1981FD1D5F20D2E0F1D6F4252A98930D587420A69750DDC1BE46932CDF979B8633054321F462557D88349459E111BE43139BEFF4A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........3......./..... z..tN...j..0,.......................................@4.......4.......................................................2.......2..3... 0.......3..k..................................p...(.....................2..............................text... z.......|.................. ..`.data...tN.......P..................@....rdata...7....!..8....!.............@..@.pdata....... 0.......0.............@..@.bss.....j...02..........................CRT..........2.......2.............@....idata...;....2..<....2.............@....rsrc....3....2..4...L2.............@.../4...........04.......3.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-3DASC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):127384
                                                                                                                                                                                                                                            Entropy (8bit):6.856313478886397
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:yq8Iw0TnMfrUEuKo+w/lT35oBqhSw3kmuqW3Crf0d3N1NsCeOEy6jCMpOEsC:yq8IdTMTyXUR2JJry3NreOnMpOu
                                                                                                                                                                                                                                            MD5:5F1A333671BF167730ED5F70C2C18008
                                                                                                                                                                                                                                            SHA1:C8233BBC6178BA646252C6566789B82A3296CAB5
                                                                                                                                                                                                                                            SHA-256:FD2A2B4FE4504C56347C35F24D566CC0510E81706175395D0A2BA26A013C4DAF
                                                                                                                                                                                                                                            SHA-512:6986D93E680B3776EB5700143FC35D60CA9DBBDF83498F8731C673F9FD77C8699A24A4849DB2A273AA991B8289E4D6C3142BBDE77E11F2FAF603DF43E8FEA105
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h8h.:.h.h.h.:.h.h)h.:.hN.fh.:.hAh1h.:.h.:.h.:.h.h'h.:.h.h?h.:.h.h<h.:.hRich.:.h........................PE..L...}..S...........!.........j......#T.......0......................................r.....@..........................c..b....Z..P........................g......<....1..............................(P..@............0..`............................text............................... ..`.rdata..r4...0...6... ..............@..@.data....0...p.......V..............@....rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-3KOLE.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):464280
                                                                                                                                                                                                                                            Entropy (8bit):6.881353710429075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:dBj8paX8fQ/T/md4OASZAOLRwRai6wXGn+hfy:dxLrLmd4OA4L8DXGnmy
                                                                                                                                                                                                                                            MD5:AD3F33BAC8EADAB224ADAF4CF6D5B97A
                                                                                                                                                                                                                                            SHA1:6CCFB97236C5AD3B48A3EB7A113E3E297422E808
                                                                                                                                                                                                                                            SHA-256:58B206AB9A3D84FDAFB537B419F721ECDEADE489707DBAB227B043D5343DB369
                                                                                                                                                                                                                                            SHA-512:C319A1C3D0D90AFEFD27DC0379C79E38993490FFA14CB281F419BC94FDE5776CD7EAB54351C57F6EAEEBCACF7F965FA0B8A8DD67489E799FCD84D39393C62A3E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]..3...3...3..d...3..d....3..d....3...6...3...7...3...0...3.......3...2...3.<.;...3.<.3...3.<....3.<.1...3.Rich..3.................PE..L....v._...........!..... ...................0............................................@..........................c.......q..(........................g.......2...W..p............................X..@............0..h............................text...@........ .................. ..`.rdata...I...0...J...$..............@..@.data................n..............@....rsrc................x..............@..@.reloc...2.......4...z..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-3MBRG.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.608714005689305
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:/toxN4m4GbUss7S2tY1wnwi9DU4liplagVMlWqOUFgaUSR708:Lm4GbnkSHunwlaiplNmlVOUaar08
                                                                                                                                                                                                                                            MD5:FE5E5B8B50F441DD772BFA1996AC744E
                                                                                                                                                                                                                                            SHA1:11D00533ADE98E94C7C6609F4E4B002A94CB440C
                                                                                                                                                                                                                                            SHA-256:A769BC72C97106722BF5CE8D76AFDC3EC54FC38931872B0637D8B7A281FFFE22
                                                                                                                                                                                                                                            SHA-512:559FB92A2C58B84AC1CDA6115AA175B0285EA98903EB1F6C91E3A0ECF39F6D667711F97D0EFF8CD98BA25256EC7B339E38D892A90186DB482587E1A80462A6EB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.^..'....'..d.]-+4.].....Q..m...bs...w.M.kTBU..5C...e.....].a..0.N+rF^.-..\......f...B).#H......XM....Ej`.q....I.3p...p:.(.Y

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-4D2E6.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):479536
                                                                                                                                                                                                                                            Entropy (8bit):5.994666279988566
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:Tch6UtcJYg8yRAkB+vsoqOvfkv+y3ilZkaCeMG:e6Utc6gdcfkv+KIR
                                                                                                                                                                                                                                            MD5:DAA81711AD1F1B1F8D96DC926D502484
                                                                                                                                                                                                                                            SHA1:7130B241E23BEDE2B1F812D95FDB4ED5EECADBFD
                                                                                                                                                                                                                                            SHA-256:8422BE70E0EC59C962B35ACF8AD80671BCC8330C9256E6E1EC5C07691388CD66
                                                                                                                                                                                                                                            SHA-512:9EAA8E04AD7359A30D5E2F9256F94C1643D4C3F3C0DFF24D6CD9E31A6F88CB3B470DD98F01F8B0F57BB947ADC3D45C35749ED4877C7CBBBCC181145F0C361065
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................& ...G.......XJ..P................................................................................................`.......P..P...............t1.......g...p..(...................................................`S...............................text.............................. ..`.data...............................@....rdata..............................@..@.pdata..t1.......2..................@..@.bss....XJ...............................CRT.........@......................@....idata.......P......................@....edata.......`......................@..@.reloc..(....p......................@..B/4..................................@..B/16.................................@..B/30.................................@..B/42.....@...........................@..B........................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-4F380.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):46468
                                                                                                                                                                                                                                            Entropy (8bit):7.994038510231404
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:knKJWrjSpYCoxMO0HqzZuCxbSbONOirgFENxbWUYfQsQB/ju9x0QhS5d7uuNMRgH:knKJorQO0KcFigi841WUYfQhju9x0OcF
                                                                                                                                                                                                                                            MD5:715D61B9BCC484E271775F36865A4CDE
                                                                                                                                                                                                                                            SHA1:8AE158AEF6F6005AA3D6E6F8A09A05FD95551784
                                                                                                                                                                                                                                            SHA-256:C4B5797588C80520745732B96D7C6681F8420BDF55E426C40B852E56E5630124
                                                                                                                                                                                                                                            SHA-512:5C8E462FA504AC91D928617C74E287B598CE326A323C8A05533D4245D018A4A4CC354D05A0568785E7642D8CF779805950D70FE167C456B2D15F8901D714C037
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:CEPACK0:....|T..?~7..,...0.(....%........%.DL...uAE.....7...k...,..c[.........I.....Bk.y..........=..n6.}.......Wf.33g..9s..[r.V!U..#9E.........?...^.&.2..c....y.b...9..<..5?x(...<..#.....Y.x8...s..t.<......:d....K~.......O_....J...Q.S.y.o.m........^....F..G..s.A....D.E.......0.&...w....R...aV^.'.r_E?Vr.Z-.=E....K..j.].^i.4..Q.#"n.x.Y.....*.l.r... ..N9.......7...m.U...o....~z........I.9. NY........N.....Q...=..bP......w..o(.P.a...7.o..V=B.Pv..I..o..-......1.sp.P(x........M...~-.......R.N7...P.o..:....0)...+.Rq.(../....L.O.e.......^..8'.{"..!.=R.\...|.o.. ..U.c.5-.~g.S..3.A....p..+.#JC.....j..;.1S... ..STX.`y...Z....f.d....SI..Q....(P|d....l0....<{...0{.r..*Pr}..*.BE....{...2/;....H..kg.o....r<j.K3.S.U.e>X.<...c.4.d7/.`....k....YV.zU........).GO....Y.x....[.9.p...q.........G...7z.....y.......a.El.*F9&...[3...XF.P.<l.rU.o.C.a.4w..jI.UeU.tUi.....*.0.O..~J..^.a.M%VzwZ.*..U.WU$..qMU..h.\..MU...A.....1<...-......'...gG.U6!X.M.s

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-4H3E6.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.561254441246199
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:OP/KrtviZQl8kimG0bj/xeRBtjajKdp2tAdNQL6aj:8/XQl823j5eRBtOjK2tGNe6aj
                                                                                                                                                                                                                                            MD5:735EAEA06DAE6CD67680127419FBA366
                                                                                                                                                                                                                                            SHA1:A38126141A4266CDBA17B22CBC4588D88CCFCEB5
                                                                                                                                                                                                                                            SHA-256:5A2D3E0F10E3701DFB251C3F270B00493CEAD1C3D1CEB34FF976D70C57DC1B58
                                                                                                                                                                                                                                            SHA-512:92374BDC99BDDDCC2A8B74049B9FF1623EE03B505BA2607E31301F95F2DF8EF3513ECAD4491E2B6B61934F64816E3E9AD3FA3B0914E96D6E55A4B4DF4ED5E028
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.....s.....N..-.........YI .....L.`0......H...Ko.Y....f....Z.pe....... ..)..3.Go...F..s.U.C....{../._U.}|.."*x..z..bn.D.>;....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-4HAOD.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):386976
                                                                                                                                                                                                                                            Entropy (8bit):6.870406853054738
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:e59aKWK/HqY5AXeWEfv6TBr4udWNrrJ710vFTAmJxQIfaCU/MC3O74r/wuMGFYsN:G9WsHse9fvcBrnd8rrR10WUxkCxC3O7S
                                                                                                                                                                                                                                            MD5:81633981057858F56BECB3BD316283E9
                                                                                                                                                                                                                                            SHA1:F6981034B1A5E23766BA4D40D451D784A1CFF83E
                                                                                                                                                                                                                                            SHA-256:4885754E6AC08304858383E47D3ADA425409988871BA6586151143D511488614
                                                                                                                                                                                                                                            SHA-512:99886CB451EAE690657AC848B63D58CD8B436849F6D073C5C073B624A6956397AC5AB6B636B1970C60DCE4EB5B3512372A4EC79FC28E9397AFE7D0791466D0A3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...0.6c...........!.....f...N......D.....................................................@.........................pB.......F..(....................|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..`............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-50KP0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):446368
                                                                                                                                                                                                                                            Entropy (8bit):6.635233277412147
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:aSn7zUunHkqypGYKKOyt8GMyKw0ORVdPpEPwkdRHhvOOZoU/wC/cQBi4Blb:nzU8E9GDWKMRPAZhvpoUOo
                                                                                                                                                                                                                                            MD5:069EC7832ADBF93BD04A91B07FF00D78
                                                                                                                                                                                                                                            SHA1:5ED84D13FFCEF487EB039CD75DE91294C25ED0CC
                                                                                                                                                                                                                                            SHA-256:8C8C608AE67F8B8A4E56DAF2EDEA1A92CBA6866D4F324BD0E5AD1284126849A7
                                                                                                                                                                                                                                            SHA-512:D9E9D40DE2509B112762ADE7EF0BB6DB91EB5687AE6EA9689ABD7A7AF8BA601297655587EEF34F7D1DAC62D77E5B586BE71B19F044EBF53028CFE90DDCE776F8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................8...Fk...................................................S...........Rich...........................PE..d...=.6c.........." ......................................................................`..........................................'.......*..(................1...d...k..............p............................................................................text...`........................... ..`.rdata...3.......4..................@..@.data....X...@......................@....pdata...1.......2...(..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-5922L.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1113504
                                                                                                                                                                                                                                            Entropy (8bit):5.932626447270598
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:3+hKmLazchlUT5PzJXmGFYKUeMzkMz7S480UJ+RNdO24a/s0X4G:Uy4n8VWGQdS480U4RN20X4G
                                                                                                                                                                                                                                            MD5:CCD151D8EE8ED05AA0E1D9142FD6E438
                                                                                                                                                                                                                                            SHA1:8D343BBC1A6F2D5D9ED8813427635696291C8F0D
                                                                                                                                                                                                                                            SHA-256:5C929F453DB7F0703BC8F939E39D48C79ECAB9E453918E5D0CD136C8026474CC
                                                                                                                                                                                                                                            SHA-512:DCB0B9A9B2908D5D55214F6A261B0A8C08889603CFABC327A7A82387012925BBF486B5C28B5250E9449FF9758748A021023C99EE02B59ABBB7B3C979A06DAEB4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0.Z't.4tt.4tt.4t..0ux.4t..7ur.4t..1u.4t.3.t~.4t&.1ui.4t&.0ue.4t&.7u~.4t..5uw.4tt.5t).4t..0uu.4t..1uu.4t..4uu.4t...tu.4t..6uu.4tRicht.4t........PE..d.....6c.........." .....\..........o........................................ ............`.............................................d......(.......<.......\........k..........@...8............................................................................textbss.A...............................text....Z...`...\.................. ..`.rdata...@.......B...`..............@..@.data...............................@....pdata..X...........................@..@.idata..r............Z..............@..@.msvcjmc8............l..............@....00cfg...............n..............@..@.rsrc...<............p..............@..@.reloc..7............v..............@..B................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-5AJNR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12502
                                                                                                                                                                                                                                            Entropy (8bit):5.40558493486102
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:0egHuderGTd4G9mSZk/8fdtINfbLmJFcSC5xm+9qh07EBS5pekFrLUK80u9ETxst:AHuderlSZk/8FtIF4umMqEpDg3fT
                                                                                                                                                                                                                                            MD5:62E1FA241D417668F7C5DA6E4009A5A6
                                                                                                                                                                                                                                            SHA1:F887409E3C204A87731F317A999DC7E4CC8D3FCD
                                                                                                                                                                                                                                            SHA-256:82E8EF7DF20A86791CEF062F2DCACB1D91B4ADC9F5DEA2FD274886BE8365B2F8
                                                                                                                                                                                                                                            SHA-512:2283CBB9E1D5D53AD1ED9BC9DB6034FB3C53C633B11001F373523640BBBBA95DA9A3A0866C7D5FA0620FACAB7D18C8577DFD69496FC7319E0A4A74D0B9E10C45
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--Defines:....--checkbox state defines..cbUnchecked=0..cbChecked=1..cbGrayed=2......--onMouseEvent button defines:..mbLeft=0..mbRight=1..mbMiddle=2..mbExtra1=3..mbExtra2=4......--memo scrollbar defines..ssNone=0..ssHorizontal=1..ssVertical=2..ssBoth=3..ssAutoHorizontal=4..ssAutoVertical=5..ssAutoBoth=6......bsNone=0..bsSingle=1..bsSizeable=2..bsDialog=3..bsToolWindow=4..bsSizeToolWin=5........--scan types: (fast scan methods)..fsmNotAligned=0..fsmAligned=1..fsmLastDigits=2....--rounding types..rtRounded=0..rtExtremerounded=1..rtTruncated=2....--scan options..soUnknownValue=0..soExactValue=1..soValueBetween=2..soBiggerThan=3..soSmallerThan=4..soIncreasedValue=5..soIncreasedValueBy=6..soDecreasedValue=7..soDecreasedValueBy=8..soChanged=9..soUnchanged=10......--debug variables..--Breakpoint methods:..bpmInt3=0..bpmDebugRegister=1..bpmException=2......--Breakpoint triggers:..bptExecute=0..bptAccess=1..bptWrite=2....--breakpoint continue methods:..co_run=0..co_stepinto=1..co_stepover=2....-

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-5R3FO.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):131480
                                                                                                                                                                                                                                            Entropy (8bit):6.84563405497219
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfrCWV13P1+CUOEvCvOEMI7:BdJPMlMb1g6e0dU9rf3P7UObvOja
                                                                                                                                                                                                                                            MD5:43DAC1F3CA6B48263029B348111E3255
                                                                                                                                                                                                                                            SHA1:9E399FDDC2A256292A07B5C3A16B1C8BDD8DA5C1
                                                                                                                                                                                                                                            SHA-256:148F12445F11A50EFBD23509139BF06A47D453E8514733B5A15868D10CC6E066
                                                                                                                                                                                                                                            SHA-512:6E77A429923B503FC08895995EB8817E36145169C2937DACC2DA92B846F45101846E98191AEB4F0F2F13FFF05D0836AA658F505A04208188278718166C5E3032
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h4h.:.h.h"h.:.h.h%h.:.hN.jh.:.hAh=h.:.h.:.h.:.h.h+h.:.h.h3h.:.h.h0h.:.hRich.:.h........................PE..L...~..S...........!.........h......wd.......@......................................EA....@.........................pr..G....j..P........................g......d....A..............................._..@............@..X............................text....,.......................... ..`.rdata...3...@...4...2..............@..@.data....0...........f..............@....rsrc................|..............@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-70BUK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):183200
                                                                                                                                                                                                                                            Entropy (8bit):6.842191242335636
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KAm/u5ImKJacvUOQC2mCDiGuTEG2BiERGNcCYOqtwyROYeoHVP0bkHnP0z:Niu5MJa9hZun2BiERaEwyOM2Qsz
                                                                                                                                                                                                                                            MD5:F1C9C9A8B035DA9385D88CA34CD49305
                                                                                                                                                                                                                                            SHA1:77E48F73C224949EC8BD8A32087609B7BF217E94
                                                                                                                                                                                                                                            SHA-256:4168D6408994A297665AEEA68ABB6C062D58EA00851751959557E7F8A8BAC17D
                                                                                                                                                                                                                                            SHA-512:D7BD2FC8592E18CA46CDF1DC74496CF3CB5EF991F4BD9E141DEEABA0F665E731A5953CAAF1CD39859817EB6D0C1B77700FE08EEED15320757B3FA36D798C4C7B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cK..'*..'*..'*....[.-*....Y..*..uB...*..uB..6*..uB..5*....X.=*....a.,*..'*..V*...C..!*...CU.&*...C..&*..Rich'*..................PE..L....(.c............................$U............@.................................(D....@..................................F..x....p...............`...k......d....7..p............................7..@............................................text............................... ..`.rdata..^...........................@..@.data........P.......@..............@....rsrc........p.......J..............@..@.reloc..d............L..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-78OBP.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):456096
                                                                                                                                                                                                                                            Entropy (8bit):6.635086574093954
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:tTaB+hAvavjZihpuXh9js6zMxfdKCXbRRUsQHoh3+KZ+a3cnldkEBX/zrMMZKUjo:haBtvavY6XhNrzSk2gxQ3Wn7kw3o
                                                                                                                                                                                                                                            MD5:AA97F366592E0FA41D2D2F61765CA7D5
                                                                                                                                                                                                                                            SHA1:BE85DAF3B07E66225CD4167F96ED6292CCE54E1E
                                                                                                                                                                                                                                            SHA-256:D63036771F21AE7E056F2211CB560BFCF79ADE356B59D8F462050B2DD840E86C
                                                                                                                                                                                                                                            SHA-512:F16D3F899504EF556D186BEBE1A526D9999454AB60697CDE221130720AB8154003543A62C4E53124C902E51FCF62B653C914B316DA0E3766DF5026E386DD47CC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......HJjD.+...+...+..iM...+..iM...+..iM...+.......+..^C...+..^C...+..^C...+..iM...+...+..S+...B...+...B...+...B...+...B...+..Rich.+..........................PE..d...3.6c.........." ................@P..............................................C.....`..........................................C......4G..(................3.......k......$... ...p............................................ ...............................text...p........................... ..`.rdata.../... ...0..................@..@.data...jX...P.......@..............@....pdata...3.......4...L..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-7Q5CB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):423328
                                                                                                                                                                                                                                            Entropy (8bit):6.077270660749132
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:gLJXTQOQV/MzZTixW5GmL7HOf0ADMTE21gFOpJz:Q+V/M9WWnL7HOf0ADMIuR
                                                                                                                                                                                                                                            MD5:8D487547F1664995E8C47EC2CA6D71FE
                                                                                                                                                                                                                                            SHA1:D29255653AE831F298A54C6FA142FB64E984E802
                                                                                                                                                                                                                                            SHA-256:F50BAF9DC3CD6B925758077EC85708DB2712999B9027CC632F57D1E6C588DF21
                                                                                                                                                                                                                                            SHA-512:79C230CFE8907DF9DA92607A2C1ACE0523A36C3A13296CB0265329208EDC453E293D7FBEDBD5410DECF81D20A7FE361FDEBDDADBC1DC63C96130B0BEDF5B1D8A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........6...2...................................................................................................p.......P..d................H.......k..........................................................LT...............................text............................... ..`.data....6.......8..................@....rdata...V...P...X...4..............@..@.pdata...H.......J..................@..@.bss.....2...............................CRT.........@......................@....idata.......P......................@....edata.......p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-8G2RP.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):443296
                                                                                                                                                                                                                                            Entropy (8bit):6.630155817797785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:bdQpG4IhjOSudLX4PGUGTdVwYr9ABfpMqYFOso5WMKYnTrLxWAld/wydfCigAA:apG4w5upwGTv9GWov1nlVAV
                                                                                                                                                                                                                                            MD5:0C7D89B75430A40824A5D7B79890324E
                                                                                                                                                                                                                                            SHA1:7E03E3D5386B1ED49104C3B35E44A545863BCBB9
                                                                                                                                                                                                                                            SHA-256:6B21B24279309F4117F8E39CDAF940F645C15D92442990A77655C8F898BB2227
                                                                                                                                                                                                                                            SHA-512:31453A2575FD7674AC7802DC8F740C79D357AD3464869F6EFD5E4A3892114EE9767715EBCA0D39E5B39CA8DA7BFED7E671D3EB24DBFB698C57ECA196D4FDFC85
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.mD............i.......i.......i........K......^.......^.......^.......i...........R...................................Rich............PE..d...8.6c.........." ................ %..............................................`{....`.........................................`........!..(................1...X...k...... .......p............................................................................text............................... ..`.rdata...).......*..................@..@.data...RX...0......................@....pdata...1.......2..................@..@.rsrc................N..............@..@.reloc.. ............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-8SLG2.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):33688
                                                                                                                                                                                                                                            Entropy (8bit):7.20956664617613
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:zVYdpNkp9TvDXy2XmVEV3GPkjVvDXy2ulqwVEV3GPkjL:zVY1+nCDOEECDbOEw
                                                                                                                                                                                                                                            MD5:4ACE42D6530AF699FEB2372F805A6A40
                                                                                                                                                                                                                                            SHA1:FB8C7352808F104E851468F25D0DD14A25B8CFCA
                                                                                                                                                                                                                                            SHA-256:13DCE393B59B9EF4A5D4FCDC27267D018B350BDC44A62AACC5DBC7F1DF7F7A1C
                                                                                                                                                                                                                                            SHA-512:8BB770F304CD8BA23FB2A64370D74AC3FDC134235FF39802983B9BABDE12AB00E49A746F3C2113520F0E135CDFD1473C0B4B64272279D13E576912126AA556D2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0............."3... ...@....... ....................................`..................................2..O....@...................g...`...... 2..8............................................ ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H........"..............................................................R..{....o.....o....&*&...}....*..0............r...p(......,.....r...po.......8.....{.....o......{....r...p(........,..{.....{....o.....r;..p(.......{..........%...o......o....o...........,e....+F....o......o....o........(....rI..p.o......o....o....(....o........X.....o....o..........-...+....+..*..(.......s ...}.....{.....o!.....{.....o"....*.0............|....(#.....,..|....($....*....0..............(%..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-9FVFL.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):28924
                                                                                                                                                                                                                                            Entropy (8bit):7.991784495689372
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:SSHnnhPVVYCzrpCuqOMWlPLe1uvY1R78Occgok:SSHnnJDXZY1RgOccK
                                                                                                                                                                                                                                            MD5:FE3637780172B207CB31BB3DC612CD34
                                                                                                                                                                                                                                            SHA1:B65FA4078DCB813EBBA16784C80BC7A0E71025DD
                                                                                                                                                                                                                                            SHA-256:080A0AE9634FB07F2E9B1DDEA31491564195865DCD2B6201E1A10A13E8CDD5E9
                                                                                                                                                                                                                                            SHA-512:8F1DA48E6F224B7E7E6EF26D11D3C484A254E9A335DA9E59B837A81F9B7DB501039F31EF9AD055A07BB139BC1147C114923742C3204156AE3371A0F225A433CC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:CEPACK......x.E.0..$.0I..`.........M......&...!.w...eC7.J .q.)Zq..u..^Y...z..+?.8C0!..T@A.k......0..s.g.......<....%.tuU.:u...SU..+...9.......3......./}...WS.....).{.Y....g..?....?...L...C9..Os..iN."w.O~..[..Rsc8~.u....3.....<s....L+s...+...3.3...............3s.{..^.s-..'.-0%r.n..2...%.F.R8.I..a.LxX..|...=...ci...cb....&.v41@..t...gy..V.7..a.....r..\..k...\j...o..Z/.{..#..Xc......xPz..2...>.~.....:n5...7..x.....Z.....n..+.....h.....t............W....j.8..m.s.k/.e\..Jc}.. W......:8z....C.i[s..9..qz.........[Z6.~.k..7....!...Tk....u...;8m3.U....|.y_.+x...A..f@6...p........I.....z..<.p.L.@.K?.a.0..O....... ..f..d0.w.>N-..E.w...L.-.b.g....{..K@.....gf.T (>.&.c..)o)7aQ#$.<.@2;.Y.......u.Wu.-....J.\hv.j..V..,.Kv.2.s.N...g.X......mf@P.....k....Q..../...Fj.5.........X{h............r...`.q+U.\.=..,Yf..).....dV..a..m.@..'iQVP....e..3.../v`@{ ..<C&...||........3..7....<.)....u+6:2.V..{......B.]ibU.r.........H*.ea..M.E.ct.m.r.+}f..X2 . ...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-9T5NT.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12807608
                                                                                                                                                                                                                                            Entropy (8bit):6.604078603198481
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:393216:ueBcnBaXXA3MnU+239JmqUKSw6knnbWUuMu25s8U:uis/c2GF
                                                                                                                                                                                                                                            MD5:5BE6A65F186CF219FA25BDD261616300
                                                                                                                                                                                                                                            SHA1:B5D5AE2477653ABD03B56D1C536C9A2A5C5F7487
                                                                                                                                                                                                                                            SHA-256:274E91A91A7A520F76C8E854DC42F96484AF2D69277312D861071BDE5A91991C
                                                                                                                                                                                                                                            SHA-512:69634D85F66127999EA4914A93B3B7C90BC8C8FAB1B458CFA6F21AB0216D1DACC50976354F7F010BB31C5873CC2D2C30B4A715397FB0E9E01A5233C2521E7716
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................./......&h..t...q...<.......@h...@.................................$........................................P...........................k..................................P@h......................\..L............................text....&h......(h................. ..`.data....t...@h..v...,h.............@....rdata..X.B...u...B...u.............@..@.bss.....q...............................CRT.........@......................@....idata...H...P...J..................@....rsrc............ .................@.../4..................................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-AKV35.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):36018
                                                                                                                                                                                                                                            Entropy (8bit):7.994007484272608
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:9vQvLQOAupOW0bBJ8RkEgh+zhlrKlfaMfToatTCCRFxg4Oaun:9Yv1bpOW0bBJ8goVUsMfcUvzOaun
                                                                                                                                                                                                                                            MD5:927EF77EFDA84808C9088632C76843E5
                                                                                                                                                                                                                                            SHA1:AA73E4C27F8A00DF4C9B8BD05088D483B5F8FF9B
                                                                                                                                                                                                                                            SHA-256:422A2989BABB5E9512C98B3FA24C4F5A0BA9A72C3C71A920C5F979316E1674C7
                                                                                                                                                                                                                                            SHA-512:98B6BA444008B5978D65FA83487465D700D6EEE721CE8990F1D2E034945F7650E7031E4B9E18C945FE81C6919E5213750DC4E2D86829988E25A3B237559E90E8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:CEPACK......|T.0~v.$9I69.$.$@.`.F..%.!.$....]"$`.t]..p.`%.x...a....R.....^.X..B........6...j......3gw...{.....|...{..3.<3..3..<3)...g.8....q\3...s...=.K...d...?.h6,...<.m..P...<.H.......$e|.........0.hiE.#?Z...II..a.?<p1..s.......1....hc....M...;..6:X|..Y.yc.sob...A<.....[l..~....#t....x....q...........q1.<1Q...X....l.g...u.....S...l..b..F...}......>.:_2.c....H.|0LPs..G...5..}@z...3.u..~o]G".....]..c.:.}......5..?.k..V......?...D.....o.-.......[N.)...K|2..E.f...(3..I.#..E.....3...O.Gv.R.U.....&."..y9-5...4..!.q'......%...!..N-....d.r-U..3,..3........'.0;..h....G.....IN...M...x(.,`M...t.C...?.,4..+...@...4-.>....;>.x(..K.&.B...4.IR..@RK....$-....R..g.Z*4:...R.@...Ry.J..M.q.u.hb....s%....A.r...2S.. .;.v...&....h.......4.[.._..[b(ih..@.}zi..N.K.....'u..$i.V.BR.[....F.I.....A&..........e,..)...P.%.Ui..|.oP.B..0&../_..R..N..(3...(.~9....2z...a.h.[O.h...S..[..S..F...a..v...83E9....U..~.@..b#c.;..YN %..m....E1D.t.d 6......h%....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-D42AS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):55173
                                                                                                                                                                                                                                            Entropy (8bit):7.995644990698608
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:1536:aPQbr8Hv6jZwnB8K5vHTcM2b9+lmFD/cEt1kbD5F:Tbr8Hv6ji75vHTx9kD/cquP
                                                                                                                                                                                                                                            MD5:3885F7AF9007DF5A9874E61EDBB45F58
                                                                                                                                                                                                                                            SHA1:F7A7719E5A9036604CC64922FF2DC4FD40D253DD
                                                                                                                                                                                                                                            SHA-256:52EAA08C57AA0BA9737ED4413786DAB747DF4C692F34BF601D4FB0B37F231D08
                                                                                                                                                                                                                                            SHA-512:CAFF16F4171D205A1B44B18651FBA7B72D33F7FDD657C5EBA44853B26929B3F48749D9C5B07F158EA903D41C09A905D27D0A4E3D7B6228550B8C255FC64D5A3D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:CEPACK.....{|SE.8~o...4$"..."...JQ.P.Z..[.*j}.E.VE..j]A[[.1........oD..)E[\.........1..."".....4e..........;....3g.9.V-O.47<..i./.........b..B...i....gB.EW.k....+'_..2....../.......E...N9=x..S.....D..>...W...g......Wr)../.s....C...}=..6.b.s[..~.?y...w.........i.M..t{.B..6..>.../W...0..k._;.*.........4.&.].....G....E.y....t....O..Wmj.K.P..ti...e...X`...I..k%;.3u....ow..D..E...:.h..D..E...r...dM.{WNS...%z...y..i...?5:..V.....F.:B]...=.gz.O.?..l.F.@.=G.....\9m..S4n.h+.wF........l..6[..W..f*........*....W..pr]X..z+..t:.......5;......a.Y.u..R.{..f......X4Tx....o2..._.1o........d7.....g.......~.....XG_.._1c....}.......|.........*0.u....-.u..N.*.y=.~..:x5..C.k....j.A.HIuQ4...cZ./.6}.X........;.:5.....0?.N.*`....x.......l..w...BEf|F..GC.h....oe....V2..B.Y...b......'.....*.q$6..k.7@M1x...i..o.Y.M....N+.N.1..x.~.r...............Qa...a..].p...._....d..$L....g..Nn.SQ[.......Mb..b|y...}....%v1....D].,Jji..(Q.h..M..G.q...[B.h.j.y`

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-DBQ9C.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):455072
                                                                                                                                                                                                                                            Entropy (8bit):6.627282046325032
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:8NqQopGY6gsnGubx5JbmZl2Wjm+9498RkaGlef/AYbAPrqEThN0dWI/mo1pdUMMe:fQoIfvxCc64fauA0lhydIo1AfDW
                                                                                                                                                                                                                                            MD5:E8DFC0D2D41483C7725E4EBB7E32D324
                                                                                                                                                                                                                                            SHA1:B2890C91EFBA390B68E481CD2EE311136B740EDE
                                                                                                                                                                                                                                            SHA-256:1172F2D7B1FB34408C8FFC248E3E719922843EA07BD5B409BE3405D1C300B3F7
                                                                                                                                                                                                                                            SHA-512:539A1BD18D4753D69756B9B7E6603DD6E7A3F354CA002DECE206F7E2F1E2792704F3D80F38B37C0C41F16A1FD9DE32CC4DD5873959D762C5AA13388715EE7803
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................8...Fi...................................................Q...........Rich...........PE..d...5.6c.........." ................P5...............................................h....`..........................................<.......?..(...............d2.......k..............p...........................p................................................text............................... ..`.rdata...8.......:..................@..@.data....X...P.......<..............@....pdata..d2.......4...H..............@..@.rsrc................|..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-FUCAS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows HtmlHelp Data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):306758
                                                                                                                                                                                                                                            Entropy (8bit):7.936079952495831
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:/UuFqUYSsTDiKebI7F03RPf2rB84daXcXrcURJo8tGgqQdB5+cbsQe/zQXE9LA2:tFhYSsnl0I7FG8S4daC/RGg1bnerQILf
                                                                                                                                                                                                                                            MD5:BB80FEC3B6E843B61859914480706CD9
                                                                                                                                                                                                                                            SHA1:0CED874BEE5BDA6059B5195911AA117693D9D2DE
                                                                                                                                                                                                                                            SHA-256:2D52F9D59211F8906ACE16525721B1400343BDF720F062CF111D84089F129009
                                                                                                                                                                                                                                            SHA-512:78D8A024DABD111B59BEEA4DC21150C7FBB3A6924201D2F3FF9E720E4BBC967BBFF285BA2064BC35C260FFDE433C639FDC0252C47AE29B43398117EDA21CF648
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:ITSF....`........2.........|.{.......".....|.{......."..`...............x.......T0.......0..............F...............ITSP....T...........................................j..].!......."..T...............PMGLS................/..../#IDXHDR..t.../#ITBITS..../#IVB...B.,./#STRINGS...O.r./#SYSTEM..v.6./#TOPICS...t.../#URLSTR...t.[./#URLTBL...t.../#WINDOWS...2.../$FIftiMain...<..8./$OBJINST...}.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...y../$WWKeywordLinks/..../$WWKeywordLinks/BTree..z.L./$WWKeywordLinks/Data...F.../$WWKeywordLinks/Map...G../$WWKeywordLinks/Property...Y ./0-ptaddresslist.html...8.S./1-ptmemoryview.html......./2-ptondebugevent.html...".../3-ptprocesswatcherevent.html...;.i$/3Dpinballforwindowspointercode.html.....s /4-ptfunctionpointerschange.html...$.2./5-ptmainmenu.html...V.]./aa_addextracommand.html...v.../aa_removeextracommand.html......./About.html...q."./Aboutb1.JPG...*.i./AboutCheatEngine.html.....U./Aboutthedebugger.html.....V./address.html...9.../Ad

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-HME12.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:DOS/MBR boot sector
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):477184
                                                                                                                                                                                                                                            Entropy (8bit):5.927630308859684
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:JEgIgQUO3gqHm5DHLj7S0/Y9kwRofaqcEL5jw/ayKImdyoO:Gg/hEm5DrHE9kwRofaqcEL5jw/ayKImD
                                                                                                                                                                                                                                            MD5:036B059F8C1CC9AFF3D010E5446BB16C
                                                                                                                                                                                                                                            SHA1:450842B84E2FACE167E2D138E4F96317CB255BB3
                                                                                                                                                                                                                                            SHA-256:248F3D48664482090D2C8C01B98518777DED1D900E17ACBC077EFE17258411A6
                                                                                                                                                                                                                                            SHA-512:4BA5E167A2E3BFE92D43759642AF7BCDB6F4C9EFA30C0F9DE85D6E9758B62FC7ED89FAFDE48910E4E059080E457E3556D23CB1D59B3062C75F81DB9C59B75657
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.$.CETC2#...............>.A..............f..p....$p1...f...pf...pf...pf.6.pf.>.pf...pf.&.p.."p...&p..(p..*p.X.,p....0p. .f..}......0.......|1....?........}..............`.............6.|...?@..|.......& |.!....Q....."|.6$|...|....s......|..........u........1.."|..."|S...J.[:..|r....."|..$|..$|:..|u...$|....$|YI...Qu.Y.....|f...|......f}....0...P.P.&f}..g}...e..e.E...X..g}...f}...<.t...e..e.E.....F....f}.....Q....f.Y...`1.....t.=..t.=..t....X...@.f1........1..f.......@s.a..DBVM BS.......U......PR>..".>..#..........R........Z.&..&.D......Ps.........r...>..".>..#.ZX.....F.<$u..PRZX.PSQW....N..$N9.r.1......0..N...u..A9.r... N...._Y[X.PSQW....N..$N9.r,1.......w...0.......a..N...u..A9.r... N...._Y[X.88=$e801:$e820:..$ax=$bx=$cx=$dx=$SMAP ERROR!..$..................$................................get VESA info success..$get VESA info failed..$ Failurevideomode 0x$..1...H..&......6........&;.........t........retry reading disk..........f1.f1........]>..?.>

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-HRQ2J.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):336600
                                                                                                                                                                                                                                            Entropy (8bit):6.344264969706984
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:6LYEDJlXw5pAnHp2ukwTX6N8B4A84zMtEl1knxgaPZ3nbanlYZn2l1S2CAYOpIOs:6LYEDJAAnHp2uk2KNO0tEQV+b3n6
                                                                                                                                                                                                                                            MD5:19D52868C3E0B609DBEB68EF81F381A9
                                                                                                                                                                                                                                            SHA1:CE365BD4CF627A3849D7277BAFBF2F5F56F496DC
                                                                                                                                                                                                                                            SHA-256:B96469B310BA59D1DB320A337B3A8104DB232A4344A47A8E5AE72F16CC7B1FF4
                                                                                                                                                                                                                                            SHA-512:5FBD53D761695DE1DD6F0AFD0964B33863764C89692345CAB013C0B1B6332C24DCF766028F305CC87D864D17229D7A52BF19A299CA136A799053C368F21C8926
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!...G.3..D....G...C.......P.......................................E...............................P.......@..P...................@....g...`...$...................................................A..t............................text....3.......4.................. ..`.data...D....P.......8..............@....rdata...a...p...b...L..............@..@.bss.....G...............................CRT.........0......................@....idata..y....@......................@....edata.......P......................@..@.reloc...$...`...&..................@..B.stab... ...........................@..B.stabstr............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-I3SCB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):122776
                                                                                                                                                                                                                                            Entropy (8bit):6.859839225631497
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:QyfNvGKKZVGcuasOKQBBTff07PSZHCSVKOCDCA32XQaOCKnOEPChMOE6:lNvG7vGcIiBTMS18RD7325YO/hMOr
                                                                                                                                                                                                                                            MD5:2A2EBE526ACE7EEA5D58E416783D9087
                                                                                                                                                                                                                                            SHA1:5DABE0F7586F351ADDC8AFC5585EE9F70C99E6C4
                                                                                                                                                                                                                                            SHA-256:E2A7DF4C380667431F4443D5E5FC43964B76C8FCB9CF4C7DB921C4140B225B42
                                                                                                                                                                                                                                            SHA-512:94ED0038068ABDDD108F880DF23422E21F9808CE04A0D14299AACC5D573521F52626C0C2752B314CDA976F64DE52C4D5BCAC0158B37D43AFB9BC345F31FDBBC0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h...h...h...:U..h...:D..h...:R..h..|....h...h...h...:[..h...:@..h..Rich.h..........PE..L...}..S...........!.........j.......K....... .......................................d....@..................................L..<....................x...g...........!..............................XB..@............ ..|............................text............................... ..`.rdata...5... ...6..................@..@.data...<0...`.......D..............@....rsrc................X..............@..@.reloc..h............Z..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-IJQFS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):210336
                                                                                                                                                                                                                                            Entropy (8bit):6.575377720318411
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:vWMJUr2f2Im9kj/FqgmHpJ1/YCVuIB9Vxv7bn1UC9gfkCeEWHFP0jHzP0Q:vWc02f2R6FqgoJ1boIPRUsfGjQQ
                                                                                                                                                                                                                                            MD5:A2C0B5D0D9E5C2A2C774E8B587850447
                                                                                                                                                                                                                                            SHA1:C8AA4CB01676D57B34AAB22C7FD018B63DFF6892
                                                                                                                                                                                                                                            SHA-256:F0F3D0FAD632D9DDAC8FF0B4EAEC20094FA0F9ABDDF784954DFBB0723A997F21
                                                                                                                                                                                                                                            SHA-512:85F4AEB562424ABF0E2BC5EDE0CDF0052FBB15E7DF70F691C11B06171A8A45A6672C2C688CD5B6FFEBEE16C36FDAC7978E39CA04F8C29F75D588D2ACA3599395
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..........rZ.....rX.:..................rY....f.`..........(......(.T....(......Rich...........PE..d....(.c..........".................<X.........@....................................^.....`.................................................L...x........................k..............p...............................................(............................text............................... ..`.rdata..............................@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-IRTAB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):149912
                                                                                                                                                                                                                                            Entropy (8bit):6.586184520889439
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:/20T06lYodB6ZcnHgSFulvfV0tYP/ipaQ8PFRBIiOBNOW:1Y6bdB6uHgSwtfV0+P/is1BIpD
                                                                                                                                                                                                                                            MD5:0EAAC872AADC457C87EE995BBF45A9C1
                                                                                                                                                                                                                                            SHA1:5E9E9B98F40424AD5397FC73C13B882D75499D27
                                                                                                                                                                                                                                            SHA-256:6F505CC5973687BBDA1C2D9AC8A635D333F57C12067C54DA7453D9448AB40B8F
                                                                                                                                                                                                                                            SHA-512:164D1E6EF537D44AC4C0FD90D3C708843A74AC2E08FA2B3F0FDD4A180401210847E0F7BB8EC3056F5DC1D5A54D3239C59FB37914CE7742A4C0EB81578657D24B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Pr.P.............As.e....Ae......At.:.....;......Al.........p....Az......Ab......Aa.....Rich............................PE..d...p..S.........." .....Z..........@|.......................................@......b.....@.............................................G.......P.... ...................g...0..h...0s...............................................p...............................text....Y.......Z.................. ..`.rdata...L...p...N...^..............@..@.data....<..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-K6MH5.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16718264
                                                                                                                                                                                                                                            Entropy (8bit):6.110071636301838
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:393216:sjcp4nsiRMX7ZbqE14ImAfltGYav/HX8h:bbqE1RmLvvY
                                                                                                                                                                                                                                            MD5:EDEEF697CBF212B5ECFCD9C1D9A8803D
                                                                                                                                                                                                                                            SHA1:E90585899AE4B4385A6D0BF43C516C122E7883E2
                                                                                                                                                                                                                                            SHA-256:AC9BCC7813C0063BDCD36D8E4E79A59B22F6E95C2D74C65A4249C7D5319AE3F6
                                                                                                                                                                                                                                            SHA-512:1AAA8FC2F9FAFECBE88ABF07FBC97DC03A7C68CC1D870513E921BF3CAEAA97128583293BF5078A69AECBB93BF1E531605B36BD756984DB8D703784627D1877D1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{..........=........@......................................e.......................................................p...........................k..................................p.|.(.......................H............................text.....{.......{................. ..`.data.........|.......{.............@....rdata...xa......za................@..@.pdata...............n..............@..@.bss.........P...........................CRT.........`.......&..............@....idata...b...p...d...(..............@....rsrc............ ..................@.../4..................................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-L1763.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2086
                                                                                                                                                                                                                                            Entropy (8bit):4.748005607182281
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:HZooJUJAimKakohOgM4TDB6liofD0x6g8W:HioemKakaOgM4J6l5C6g8W
                                                                                                                                                                                                                                            MD5:650C02FC9F949D14D62E32DD7A894F5E
                                                                                                                                                                                                                                            SHA1:FA5399B01AADD9F1A4A5632F8632711C186EC0DE
                                                                                                                                                                                                                                            SHA-256:C4D23DB8EFFB359B4AA4D1E1E480486FE3A4586CE8243397A94250627BA4F8CC
                                                                                                                                                                                                                                            SHA-512:F2CAAF604C271283FC7AF3AA9674B9D647C4AC53DFFCA031DBF1220D3ED2E867943F5409A95F41C61D716879BED7C888735F43A068F1CC1452B4196D611CB76D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview://credits: ms d3d tutorials which I hacked apart....Texture2D txDiffuse : register( t0 );..SamplerState samLinear : register( s0 );....cbuffer ConstantBuffer : register( b0 )..{....float4x4 rotation;.. float2 originpoint;...float2 translation;...float2 scaling;...float transparency;....float garbage;...}..........//--------------------------------------------------------------------------------------..struct VS_INPUT..{.. float4 Pos : POSITION;.. float2 Tex : TEXCOORD0;..};....struct PS_INPUT..{.. float4 Pos : SV_POSITION;.. float2 Tex : TEXCOORD0;..};......//--------------------------------------------------------------------------------------..// Vertex Shader..//--------------------------------------------------------------------------------------..PS_INPUT VS( VS_INPUT input )..{.... PS_INPUT r=input;.. float4 rp;........ r.Pos[0]-=originpoint[0];.. r.Pos[1]+=originpoint[1];.. r.Pos=mul(r.Pos, rotation);.... r.Pos[0]+=originpoint[0];.. r.Pos[

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-L3N0T.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):140696
                                                                                                                                                                                                                                            Entropy (8bit):6.856834819192468
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlERbo3iV8n/7DkCWy:o4YqoZNHi7VBAXvXMZ7ll3iyn3WOR3Oc
                                                                                                                                                                                                                                            MD5:42E2BF4210F8126E3D655218BD2AF2E4
                                                                                                                                                                                                                                            SHA1:78EFCB9138EB0C800451CF2BCC10E92A3ADF5B72
                                                                                                                                                                                                                                            SHA-256:1E30126BADFFFB231A605C6764DD98895208779EF440EA20015AB560263DD288
                                                                                                                                                                                                                                            SHA-512:C985988D0832CE26337F774B160AC369F2957C306A1D82FBBFFE87D9062AE5F3AF3C1209768CD574182669CD4495DBA26B6F1388814C0724A7812218B0B8DC74
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.u...&...&...&.@r&...&.@d&...&.@c&...&=.,&...&2@{&...&...&...&.@m&...&.@u&...&.@v&...&Rich...&........................PE..L...~..S...........!.....@...z......*l.......P......................................x.....@.........................`...G...l...P........................g...........Q.................................@............P..X............................text....>.......@.................. ..`.rdata...E...P...F...D..............@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-LB5OD.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3223968
                                                                                                                                                                                                                                            Entropy (8bit):6.338087367720092
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TYfx:0HDYsqiPRhINnq95FoHVBT333T+
                                                                                                                                                                                                                                            MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
                                                                                                                                                                                                                                            SHA1:9752F38CC51314BFD6D9ACB9FB773E90F8EA0E15
                                                                                                                                                                                                                                            SHA-256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
                                                                                                                                                                                                                                            SHA-512:B0A00082C1E37EFBFC2058887DB60DABF6E9606713045F53DB450F16EBAE0296ABFD73A025FFA6A8F2DCB730C69DD407F7889037182CE46C68367F54F4B1DC8D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1......u1...@......@....................-.......-..9....................0..k....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-MQ1KH.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):271256
                                                                                                                                                                                                                                            Entropy (8bit):6.040002515360521
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:XcxPVJy83/NkY56owwouBQGsyTfkaiX6P0a:XkPV483FB56wsyTfkOJ
                                                                                                                                                                                                                                            MD5:F9C562B838A3C0620FB6EE46B20B554C
                                                                                                                                                                                                                                            SHA1:5095F54BE57622730698B5C92C61B124DFB3B944
                                                                                                                                                                                                                                            SHA-256:E08B035D0A894D8BEA64E67B1ED0BCE27567D417EAAA133E8B231F8A939E581D
                                                                                                                                                                                                                                            SHA-512:A20BC9A442C698C264FEF82AA743D9F3873227D7D55CB908E282FA1F5DCFF6B40C5B9CA7802576EF2F5A753FD1C534E9BE69464B29AF8EFEC8B019814B875296
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....d..t....-...........................................0.................................................................P........................g......h.......................................................0............................text....d.......f.................. ..`.data...t............j..............@....rdata..............................@..@.pdata...........0...`..............@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@....reloc..h...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-MQPUR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1112834
                                                                                                                                                                                                                                            Entropy (8bit):7.995534990823338
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:H1XCCswrgMlbH4v3Cj6N3yHORtmV7VJPX/uPQDNDcpLwBlxaZm5g5Gvh6at0:ACRlbHhj6N3vR4Vt/uSN2L6LaZAgcvHC
                                                                                                                                                                                                                                            MD5:38B22DEDFBCAFE1376ACEB7A0722FB8F
                                                                                                                                                                                                                                            SHA1:6C96AA4E7C71C82A82951443BA6DAE9019601E55
                                                                                                                                                                                                                                            SHA-256:F092D81531B8603A52F70245D041E2C43B020280BD9F358172330FF405E451CD
                                                                                                                                                                                                                                            SHA-512:135EF19161572A57AE1BC618C6CC7FDE889BD1A5C88E6125080C3712E7F0AE96F2A9B7728765C1B115F91CE48200CA47CA0C43E31625CBD11DFFA181610F03CA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:CEPACK..&..}|T.7~Nf.L...@..".2(..Di....M#.....(meJ.(7...'..'.f.0.k..V.....k...QQf...HqB(N.b@jO.T..&C.2...93.....y>...=s.w.....k...R..zN.q...H..8._....U.3i.[...i.........5{K.3.-.....|...g.{cv..t....^..U..yb..'...4JD.[...I...t.x]f...c.y#8.....U..;I.....ro....M..Qo..?&.....g......|.?.^w#......%@OV.wO....r.x..7.#.PFJP...B...9n.O|..-.F>.w....1...[.....^6..q......p..~{.V..<-Xp.z..z....m..........=5......n.......}..).....x...........,.m...0......1.....>..^._d...~...<.........b=...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...Q..3..`#.M..dp..g38..f./d.b..2x...2x.........^.....f.z.o`..........v..`p9...\..Z..dp=.w1.E..e.>..g...70. ...|.....ap;.;..c.)...|......`.....2x..!.....c.7...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...q..3..`#.M..dp..g38..f./d.b..2x...2x...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-MTART.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):268704
                                                                                                                                                                                                                                            Entropy (8bit):5.837891086948313
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:0drkqKo/nt7PrwnoK0M6EZgugEkkoSE5O7Z3LLr:6rkm9mP6EZgugEnoSE5OB
                                                                                                                                                                                                                                            MD5:9A4D1B5154194EA0C42EFEBEB73F318F
                                                                                                                                                                                                                                            SHA1:220F8AF8B91D3C7B64140CBB5D9337D7ED277EDB
                                                                                                                                                                                                                                            SHA-256:2F3214F799B0F0A2F3955DBDC64C7E7C0E216F1A09D2C1AD5D0A99921782E363
                                                                                                                                                                                                                                            SHA-512:6EEF3254FC24079751FC8C38DDA9A8E44840E5A4DF1FF5ADF076E4BE87127075A7FEA59BA7EF9B901AAF10EB64F881FC8FB306C2625140169665DD3991E5C25B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...............................d)..`........ ....@.................................:8..........................................d........................k...................................3.......................................................text............................... ..`.data........ ......................@....rdata...g...@...h...(..............@..@.bss....d)...............................CRT................................@....idata..N...........................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-N3N08.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3208608
                                                                                                                                                                                                                                            Entropy (8bit):6.4378051911330445
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:itwSHCeicAlYJhPx7Ur4+Kn8KTqeUrncXbvTCeVxkg8vL5V2zRkit6bch6WuDgR1:itwAf64swnNmnfsR3ccJkKSib
                                                                                                                                                                                                                                            MD5:0D4BDC37F5031A827B2877770974FE49
                                                                                                                                                                                                                                            SHA1:7D7D63F1CC49FB94D2FD59AF8A0BA89966CE0E07
                                                                                                                                                                                                                                            SHA-256:F3C536EC5307D71260FA5D6D70AC56A20A00DBC3FB785E0DEB4EF0F7DC66FC2E
                                                                                                                                                                                                                                            SHA-512:D1FAF9BCF6BBF6E458780F4D913BA600A5F987FF33BE8D24A1165F5BFA925B2D1DFFDAA6E666712D09D58478174BC2956877A4A60376F7773D1E818BB38A23E1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........................d...D....-.......0....@..........................@1.......1.......................................-...... ................0..k..................................P0......................8.-.\............................text............................... ..`.data...d....0......................@....rdata...=... %..>....%.............@..@.bss....D....`-..........................CRT..........-......F-.............@....idata.../....-..0...H-.............@....rsrc........ .......x-.............@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-NBC6R.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):187288
                                                                                                                                                                                                                                            Entropy (8bit):6.46399109534477
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:XMTS4QqrM7BqUHEwXDVT6B8AF6aBBcFkLODeYJObCkEjOUkOG:XIQqrc7V5Trw6aBBcFk6CtbID4
                                                                                                                                                                                                                                            MD5:4A3B7C52EF32D936E3167EFC1E920AE6
                                                                                                                                                                                                                                            SHA1:D5D8DAA7A272547419132DDB6E666F7559DBAC04
                                                                                                                                                                                                                                            SHA-256:26EDE848DBA071EB76C0C0EF8E9D8AD1C53DFAB47CA9137ABC9D683032F06EBB
                                                                                                                                                                                                                                            SHA-512:36D7F8A0A749DE049A830CC8C8F0D3962D8DCE57B445F5F3C771A86DD11AAA10DA5F36F95E55D3DC90900E4DBDDD0DCC21052C53AA11F939DB691362C42E5312
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d../ .t| .t| .t|f.|..t|f.|_.t|f.|*.t|.B.|#.t| .u||.t|.#.|9.t|.#.|!.t|-.|!.t|.#.|!.t|Rich .t|................PE..d....d.W.........." ................t................................................f....`..........................................4.......:..(....................t...g..............8...........................p...p............................................text............................... ..`.rdata..(...........................@..@.data....K...P.......4..............@....pdata...............R..............@..@.rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-NPNPQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):266648
                                                                                                                                                                                                                                            Entropy (8bit):6.017604835530295
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KK2iOI60nWU4NJ4twEywGLOJQbcOL9z32fY8iV1OQfkz5w4Q7hk1D2oOyPOP:KKu0WU4J0w6xJkBAY8i7fkaThkA4g
                                                                                                                                                                                                                                            MD5:DD71848B5BBD150E22E84238CF985AF0
                                                                                                                                                                                                                                            SHA1:35C7AA128D47710CFDB15BB6809A20DBD0F916D8
                                                                                                                                                                                                                                            SHA-256:253D18D0D835F482E6ABBAF716855580EB8FE789292C937301E4D60EAD29531D
                                                                                                                                                                                                                                            SHA-512:0CBF35C9D7B09FB57D8A9079EAB726A3891393F12AEE8B43E01D1D979509E755B74C0FB677F8F2DFAB6B2E34A141F65D0CFBFE57BDA0BF7482841AD31ACE7790
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".... Z..........`........................................ .......U..........................................................P............p.. ........g......0...................................................@................................text... Z.......\.................. ..`.data........p.......`..............@....rdata...............z..............@..@.pdata.. ....p...0...T..............@..@.bss.....................................CRT................................@....idata..............................@....edata..............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-NUSO1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):309664
                                                                                                                                                                                                                                            Entropy (8bit):5.8237432164000404
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:TDwf7I4zq0ZDVQ5uIqp5rkenPajp80Gc5:T0f7Bz/G5uImQaPajp3
                                                                                                                                                                                                                                            MD5:59089C96334966EDFFC70BF4AE829910
                                                                                                                                                                                                                                            SHA1:8DC37D6F2364749D52DB1BCB9AD9FE30FB93930D
                                                                                                                                                                                                                                            SHA-256:49A55638C5A0F8112B89C45A24A2BCD102FF5DE2D22386649D7F6FFD283AF1FD
                                                                                                                                                                                                                                            SHA-512:3EDD411905298FDE78DF57B063B4B2000FA2D16F0E1A14E8940D4FBC2226C1CBA6925C47D3BECC10E76BBA9C5864CF671F5EF3B29CFA430823D0FA9BF9BBC3A9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................e.......).. .............@.........................................................................`..d....p...............N...k......|...........................P........................b...............................text....e.......f.................. ..`.data................j..............@....rdata...~..........................@..@.bss.....)... ...........................CRT.........P......................@....idata.......`......................@....rsrc........p......................@....reloc..|........0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-O5I1D.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):308120
                                                                                                                                                                                                                                            Entropy (8bit):6.921402988579037
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:3QMsoykzuYV4SPaa/Gr+RBmRQ5wipE04CIcFw6eAwE5Sm1Q5jsV+XkO4qOT:3NJyTuxkC57IZEzGmT
                                                                                                                                                                                                                                            MD5:462322CC93E55016D5EA78B2B9823657
                                                                                                                                                                                                                                            SHA1:3E8E00B690A4370D6F2DFDCF730F2D3FDA4806A6
                                                                                                                                                                                                                                            SHA-256:AEDC048FCFEC594E7307E4730D850E5E0121820A76CA1A363F4A2E41D084F393
                                                                                                                                                                                                                                            SHA-512:A46E56130A8D1CA588D9935D98468543328B42492F1257157D2C7FD99AC341E8A22337AC2228AECF33A70913A7E7161B300BB458E1C07D5D0B94A7AA1DD72D79
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t.....q.q...y.W.P...y.i.b...y.V......D}.}...t...+....%R.\....%j.u...y.m.u....%h.u...Richt...........................PE..L...h.&V...........!.....p................................................................@.....................................d....P...............L...g...`..@E......8...............................@...............T............................text....o.......p.................. ..`.rdata...v.......x...t..............@..@.data....@..........................@....rsrc........P......................@..@.reloc..@E...`...F..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-OETFQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1491
                                                                                                                                                                                                                                            Entropy (8bit):5.150461183336365
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:c3UnepmoqbOOrYFlrJYrYFIzLQ9Zonc432smXOkuEWRO632s3yOtTf1p13to+Zqh:xOOrYj2rYCzeqnc432sem32s3xtD13tQ
                                                                                                                                                                                                                                            MD5:1EE5923E90E9DB03EF80F6DA5C14FB7B
                                                                                                                                                                                                                                            SHA1:BCB456DB885C932605F4DCFFABBF771BC7CB5C41
                                                                                                                                                                                                                                            SHA-256:1A971954CD09C202E73E625329EE4DDF7291C7C0E155A1086DA7FAAC1957C94B
                                                                                                                                                                                                                                            SHA-512:8A008D4FAEE52F76A6C9024DE88963261730FA12EB54B0BE5FB80F8CC02CF7FEC0EFC126A209A646BE17D91B78FFC2E54BAAB7E346474BCFFFD92D3C942E959F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Copyright 2018 Alex Ionescu. All rights reserved.....Redistribution and use in source and binary forms, with or without modification, are permitted provided..that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this list of conditions and.. the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions.. and the following disclaimer in the documentation and/or other materials provided with the.. distribution.....THIS SOFTWARE IS PROVIDED BY ALEX IONESCU ``AS IS'' AND ANY EXPRESS OR IMPLIED..WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND..FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ALEX IONESCU..OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR..CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS..OR SERVICES; LOSS OF USE,

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-PIADI.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):201
                                                                                                                                                                                                                                            Entropy (8bit):4.465403493165412
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:JW4+sNv/lQBAHpbs/UcUFJKPACcAE8J6Xv:JB+slzs/tUrKcbXv
                                                                                                                                                                                                                                            MD5:62771A63FDC87764BFF87D82918AB02A
                                                                                                                                                                                                                                            SHA1:8E468DED8CED87A10470BD5594337A854FF344BA
                                                                                                                                                                                                                                            SHA-256:5C16124BA0B39214BECB1AF4161BD82147AD8468879A3FD8E9FACC656A1D2E6F
                                                                                                                                                                                                                                            SHA-512:8D1792B712504336CAC0B175146F2B7EAEDA043BD3941C7B7C54CF926A4BA4835F0EFF7A2AD5C7B5509F80E7420C3F5F94200D4C3F922DB92B807E20E09A84D0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--This lua script gets loaded when Cheat Engine loads..--You can use this to define some often used functions and libraries you'd like to use....require("defines")....--for documentation read celua.txt

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-PJLMD.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):99199
                                                                                                                                                                                                                                            Entropy (8bit):7.9924368254113025
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:1536:CGNxLS1cRzW1Dx15WXGNp7u4A3AP6ovMlJEyWYykDQdTkQRWMJv2kXWMFopxLZq5:QcFW1DdDrTP6o0jEyERskXepHqz9
                                                                                                                                                                                                                                            MD5:EC8679FCB11314E333F6518113F1D71E
                                                                                                                                                                                                                                            SHA1:F6642D2551238733324141810B12C964FFE3B518
                                                                                                                                                                                                                                            SHA-256:45CFE56AE9CBB58FC51700425A19771C87029F63CB1A96CB258AEBE6AEE9D37A
                                                                                                                                                                                                                                            SHA-512:71EF7CBACD90317D32B0E4E81F64B6A4BABF644A1391396E9FF6C000C902660CFE87E5A86DF456EF5FB2DE0E6688BBF0778AB917D98BC86FB81AEA658672B4DB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:CEPACK.....}}|S.....m....B..k...U7.....Q.@..u.a...V.`...zz..6.~u..'.lCe...(i...2M)....dzK.F.m(.....4.....~....M..s...<.y.s.M.]>F.0..O,.0-..W.......?.....\......+.>..p].c.........9...@a......-\r...G.[......U....,c.R..1.>..O...53.fI)..7.2L..S..N..U.W..DD.|..,~...SJcz....z.,....*...4.Sz...t....lrb..G.P........}.....C..@.>..;t).......e...#.._..+.....c.i.....W......?.z..........-i.ui.U.......Z3....[.....O.b........I.....4..x.&n...h..4.bM.:M|.&.@./..h.VM|.&^.....Wk..h..i.k4....:M..o..5.:M.A.o....}.........fM|.&.U...o..wh.-..nM.....4.x@.?...5..x.&~Z..5..M<...j..M<..3...9M...5q.&....h..5.BM......i...u..|M|.&^../....2M.B._............h.k5.5.u..S...Wk.u.x.&..&.......7k.[4..6M|.&.C.oI..k./m|s.o..9....%.(.Mu..N-b..s/..!1.V.).s<~\....d...U...m..((...|._...{...y70/.A.X....b... ....@:..l3..tdT`....b...>Z*..!......~.'....G:XF...H\."....%...T.+^x~.....?b.......}S...0........+.9UP.l...........v.O..].?...6.....g1.s.i...,.0..[...<.C.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-PJPBU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4210080
                                                                                                                                                                                                                                            Entropy (8bit):6.041283402178925
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:aMiOO5AqojVbq2s2Kyvzq/9E3piKR+77v5WiESldKtyQ6WuDgRPOjgy+OSijV:aMiOOaBbq2VVvnlykESip
                                                                                                                                                                                                                                            MD5:AEC662CEAE2C4D5ABAEEEE084D828582
                                                                                                                                                                                                                                            SHA1:A57CEB95E3FD3F8E8C59C0B7E913E2681B64751D
                                                                                                                                                                                                                                            SHA-256:2DD35A044D1291D593F1DA15C40FD124DA3E4D52D0D045EC61465B725E58079D
                                                                                                                                                                                                                                            SHA-512:FF28EB79795A6D4AD97A5C79CEB5314208C616BE7CC9196622B9BB2AB8149C6CAA166EED6165923DC8FA253A400422CBEE9E061E72DCF61CE66C700D1451AE7A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......#..m......-........................................@...... A......................................................@=.......=......0:.Ta....?..k..................................p.$.(....................O=..............................text.....#.......#................. ..`.data....m....$..n....#.............@....rdata.......p*......b*.............@..@.pdata..Ta...0:..b....:.............@..@.bss.........<..........................CRT.........0=......~<.............@....idata..@>...@=..@....<.............@....rsrc.........=.......<.............@...................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-Q6VO1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):386976
                                                                                                                                                                                                                                            Entropy (8bit):6.870368063282166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:359aKWK/HqY5AXeWEfv6TBr4udWNrzJD10P9TQmxhAIXiCUXEC+Y4r/w2MGkTkm/:J9WsHse9fvcBrnd8rzZ10eMhEChC+Ygi
                                                                                                                                                                                                                                            MD5:486237BC5FA41DCE8C3022B9B6221FE5
                                                                                                                                                                                                                                            SHA1:C00BA51895DEAB2054C6F0F7DD3CF397E119C6FE
                                                                                                                                                                                                                                            SHA-256:4E2C87700CCDD3B34215C6BC64AE4582AC5FF373CFD3E93E8F7D2016960BA80D
                                                                                                                                                                                                                                            SHA-512:5F4010D8F9B0C865DE209E90625F178C8A7370AF1F7BE85552147EBD9EE7D033B01DD5A277FB646E2D289D2821462ADBB0959E507CD0A044CE79CB1C526A385B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...;.6c...........!.....f...N......D.....................................................@..........................B......$F..(....................|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..t............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-Q7DRT.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):541592
                                                                                                                                                                                                                                            Entropy (8bit):6.56379573889746
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:FshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5T:hOL9J2L8E5VKKSuLGEhXGstCXoYkc7BV
                                                                                                                                                                                                                                            MD5:B7C9F1E7E640F1A034BE84AF86970D45
                                                                                                                                                                                                                                            SHA1:F795DC3D781B9578A96C92658B9F95806FC9BDDE
                                                                                                                                                                                                                                            SHA-256:6D0A06B90213F082CB98950890518C0F08B9FC16DBFAB34D400267CB6CDADEFF
                                                                                                                                                                                                                                            SHA-512:DA63992B68F1112C0D6B33E6004F38E85B3C3E251E0D5457CD63804A49C5AA05AA23249E0614DACAD4FEC28CA6EFDB5DDEE06DA5BFBFA07E21942976201079F3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.............q.R.....q.P.....q.Q.....y......y......y.......i0............Vx......Vx......Vx\.....Vx......Rich............PE..d....w._.........." .................:....................................... ......&.....`.........................................0f..p....t..(................Q.......g......\.......p............................................................................text............................... ..`.rdata..............................@..@.data...8............n..............@....pdata...Q.......R...|..............@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-QJSEK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.551821770808043
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:SNjBeQx+FGOujzBAk+skvy2a4nfJKnBTa6C:+jkk+dsAk+Fzag+BTab
                                                                                                                                                                                                                                            MD5:ADAFB7CDCA51FC803718F25172652DD3
                                                                                                                                                                                                                                            SHA1:DD882B60A842B0992F478349898415A857934330
                                                                                                                                                                                                                                            SHA-256:B1B61B2570DBAF2747C4862B8429424514D300A7E14B5065C8BBB4B751179E7E
                                                                                                                                                                                                                                            SHA-512:D0B3D17F0F1EFB8F2F0BCAA1295AED08043F0218BCFA092A47D46308911EC4BC2441711CAB300B852DE3DBCED1C83536750B1A77A75EAE5C8CBF95991AA88714
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.CaG.(9......q.5..4S..%..+...U*.>{5.......M.....-..kF.....7.."z..W.Lc...."6/.V.N..p.YC?...:m.D.k.T....u.0...c.U.h...\;1`.`B..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-RBU7H.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):202648
                                                                                                                                                                                                                                            Entropy (8bit):6.566120700945174
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:fr03mcDwt5b2+z615yQ7SLVTnyJYpgerOEmgsRBZnwO4oO8:fg3mrHb2+z615yQ7GnyOpFOEFKD2G
                                                                                                                                                                                                                                            MD5:9F50134C8BE9AF59F371F607A6DAA0B6
                                                                                                                                                                                                                                            SHA1:6584B98172CBC4916A7E5CA8D5788493F85F24A7
                                                                                                                                                                                                                                            SHA-256:DD07117ED80546F23D37F8023E992DE560A1F55A76D1EB6DFD9D55BAA5E3DAD6
                                                                                                                                                                                                                                            SHA-512:5CCAFA2B0E2D20034168EE9A79E8EFFF64F12F5247F6772815EF4CB9EE56F245A06B088247222C5A3789AE2DCEFADBC2C15DF4FF5196028857F92B9992B094E0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........d....*........... ...............................@......D...........................................P........................g.......#......................................................d............................text............................... ..`.data...d.... ......................@....rdata..,c...@...d..................@..@.bss.....*...............................CRT.................~..............@....idata..............................@....edata..............................@..@.reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-RJ6EI.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):206232
                                                                                                                                                                                                                                            Entropy (8bit):6.577803539808585
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:ZyuXZus0fJ34+UZQ5IvR2diworEdVpRmY:nXZgV4dkIJfrEdVt
                                                                                                                                                                                                                                            MD5:DE625AF5CF4822DB08035CC897F0B9F2
                                                                                                                                                                                                                                            SHA1:4440B060C1FA070EB5D61EA9AADDA11E4120D325
                                                                                                                                                                                                                                            SHA-256:3CDB85EE83EF12802EFDFC9314E863D4696BE70530B31E7958C185FC4D6A9B38
                                                                                                                                                                                                                                            SHA-512:19B22F43441E8BC72507BE850A8154321C20B7351669D15AF726145C0D34805C7DF58F9DC64A29272A4811268308E503E9840F06E51CCDCB33AFD61258339099
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........t...D)..0........ ...............................@..................................................P........................g.......#...................................................................................text............................... ..`.data...t.... ......................@....rdata..0d...@...f... ..............@..@.bss....D)...............................CRT................................@....idata..............................@....rsrc...............................@....reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-S8B9H.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):161688
                                                                                                                                                                                                                                            Entropy (8bit):6.832669552984183
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:K3uc99F6AOdjfTOZztxlGWGXLQbcpNk6FowD6QcEY7Xjl5hf8keDQa/c7usWjcd6:K3ukXTNGp7+6zaEY7Zf/a0ye3ZoOvKOS
                                                                                                                                                                                                                                            MD5:DF443813546ABCEF7F33DD9FC0C6070A
                                                                                                                                                                                                                                            SHA1:635D2D453D48382824E44DD1E59D5C54D735EE2C
                                                                                                                                                                                                                                            SHA-256:D14911C838620251F7F64C190B04BB8F4E762318CC763D993C9179376228D8CA
                                                                                                                                                                                                                                            SHA-512:9F9BEA9112D9DB9BCECFC8E4800B7E8032EFB240CBBDDAF26C133B4CE12D27B47DC4E90BC339C561714BC972F6E809B2EC9C9E1FACC6C223FBAC66B089A14C25
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..U~...~...~...s...^...s.#.i...s.......w.o.}...~...'....v..g....v .....s.'......v".....Rich~...........................PE..L....d.W...........!.........................................................p......w.....@................................. ...(....@...................g...P..(...p...8...........................h...@...............4............................text............................... ..`.rdata...T.......V..................@..@.data... =..........................@....rsrc........@......................@..@.reloc..(....P......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-TPR80.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):135064
                                                                                                                                                                                                                                            Entropy (8bit):6.612681349758152
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:ZGrrgbU27p/nFdpF/vwFLUjh2v5VjObfSVMPFtE8PdYO3kOc:crk3ZFdpRYUjh2verh6
                                                                                                                                                                                                                                            MD5:2AF7AFE35AB4825E58F43434F5AE9A0F
                                                                                                                                                                                                                                            SHA1:B67C51CAD09B236AE859A77D0807669283D6342F
                                                                                                                                                                                                                                            SHA-256:7D82694094C1BBC586E554FA87A4B1ED6EBC9EB14902FD429824DCD501339722
                                                                                                                                                                                                                                            SHA-512:23B7C6DB0CB9C918AD9F28FA0E4E683C7E2495E89A136B75B7E1BE6380591DA61B6FB4F7248191F28FD3D80C4A391744A96434B4AB96B9531B5EBB0EC970B9D0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........nV..............................*%..........................Rich............PE..d...p..S.........." .....&...~......0\...............................................8....@.................................................l...<........................g......$....C...............................................@...............................text....%.......&.................. ..`.rdata..~K...@...L...*..............@..@.data....;...........v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-U75H1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):144280
                                                                                                                                                                                                                                            Entropy (8bit):6.553148474736184
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:Kd3u82FbW5v1B9omLKfBbYWFhFCsfa5z8saPFZ1sL3OD1Ow:Kd+NFbWUMKfBTjFxfa5a1y4N
                                                                                                                                                                                                                                            MD5:0DAF9F07847CCEB0F0760BF5D770B8C1
                                                                                                                                                                                                                                            SHA1:992CC461F67ACEA58A866A78B6EEFB0CBCC3AAA1
                                                                                                                                                                                                                                            SHA-256:A2AC2BA27B0ED9ACC3F0EA1BEF9909A59169BC2EB16C979EF8E736A784BF2FA4
                                                                                                                                                                                                                                            SHA-512:B4DDA28721DE88A372AF39D4DFBA6E612CE06CC443D6A6D636334865A9F8CA555591FB36D9829B54BC0FB27F486D4F216D50F68E1C2DF067439FE8EBBF203B6A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..7...d...d...d..Vd{..d..@d...d..Qd9..d...d...d.Id...d...dq..d.._d...d..Gd...d..Dd...dRich...d........PE..d...p..S.........." .....F...........t.......................................0............@.........................................p...G......P........................g... ..h...0c...............................................`...............................text...fD.......F.................. ..`.rdata...J...`...L...J..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-UP51K.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):140184
                                                                                                                                                                                                                                            Entropy (8bit):6.5832665674944435
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:6UoPePVhoZB34/UWFdQomnRepTPFn35eoONSO2:j8ZBvWrnmnR2Un+
                                                                                                                                                                                                                                            MD5:61BA5199C4E601FA6340E46BEF0DFF2D
                                                                                                                                                                                                                                            SHA1:7C1A51D6D75B001BA1ACDE2ACB0919B939B392C3
                                                                                                                                                                                                                                            SHA-256:8783F06F7B123E16042BB0AF91FF196B698D3CD2AA930E3EA97CFC553D9FC0F4
                                                                                                                                                                                                                                            SHA-512:8CE180A622A5788BB66C5F3A4ABFDE62C858E86962F29091E9C157753088DDC826C67C51FF26567BFE2B75737897F14E6BB17EC89F52B525F6577097F1647D31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.k6...e...e...e...e{..e...e...e...e9..e...e...e..e...e...es..e...e...e...e...e...e...eRich...e........PE..d...p..S.........." .....4...........b....................................... .......1....@......................................... ...b...D...P........................g......h...@S...............................................P...............................text....2.......4.................. ..`.rdata...L...P...N...8..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-VBUE0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):205720
                                                                                                                                                                                                                                            Entropy (8bit):6.5406944146931805
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KNyaW1Pg7kFtOp8+vRha0DAyheYn13qaIhRFXOucMEx33sOZrcOo:KNyal78m8+vRMEe4a4OEtTi
                                                                                                                                                                                                                                            MD5:6E00495955D4EFAAC2E1602EB47033EE
                                                                                                                                                                                                                                            SHA1:95C2998D35ADCF2814EC7C056BFBE0A0EB6A100C
                                                                                                                                                                                                                                            SHA-256:5E24A5FE17EC001CAB7118328A4BFF0F2577BD057206C6C886C3B7FB98E0D6D9
                                                                                                                                                                                                                                            SHA-512:2004D1DEF322B6DD7B129FE4FA7BBE5D42AB280B2E9E81DE806F54313A7ED7231F71B62B6138AC767288FEE796092F3397E5390E858E06E55A69B0D00F18B866
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...G ........)...........0...............................@..........................................@.......P........................g......."......................................................h............................text... ........................... ..`.data........0......................@....rdata..._...P...`...*..............@..@.bss.....)...............................CRT................................@....idata..=...........................@....edata..@...........................@..@.reloc...".......$..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\is-VKJIS.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1882
                                                                                                                                                                                                                                            Entropy (8bit):4.658116184932645
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:60wIlJhxWXs/2h8OjrGCLyO7OjO6NsVhVyQk7FUBL9HuTsx0refVS+IsZZsznGd2:HTP8gE8OvnKy6NsVu7FYLswlW/
                                                                                                                                                                                                                                            MD5:CC0F8B66BFEDC67DA8DBB2A7DF2AA006
                                                                                                                                                                                                                                            SHA1:C6D86CC43A042581E389DC9A28AFFDDF64294AC8
                                                                                                                                                                                                                                            SHA-256:CDDD0F35F7351E6F19486CCD7EEE5D31F0134C5C3554A12C7D51131DDE8E29CD
                                                                                                                                                                                                                                            SHA-512:A4AEC40AC6BEA2ADACF15829AEEEBE66117473A542303024669A828710C6AFD072C0F4890A6A334B35AC894A1A80A5BDD5E91A6FFCB7149540E304117A7E5800
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#write down modulenames that are commonly used by games..#this decreases the number of wrong results in various types of memory inspection....1911.dll..speedtreert.dll..visionengineplugin.vplugin..vision90.dll..vbase90.dll..nvscpapi.dll..physxcore.dll #nvidia physx..nxcooking.dll..physxloader.dll..physxextensions.dll..cudart.dll..openal32.dll..vorbisfile.dll..ogg.dll..vorbis.dll..vorbisenc.dll..vorbisfile.dll..binkw32.dll..bink2w64.dll..iconv.dll..gameoverlayrenderer.dll #steam..steam_api.dll..steam_api64.dll..steamclient.dll..steamclient64.dll..tier0_s.dll..vstdlib_s.dll..steam.dll..steam2.dll..mss32.dll..dbghelp.dll..umbra.dll..unrar.dll....#CE dll's..cehook.dll..allochook.dll..allochook-x86_64.dll..allochook-i386.dll..vehdebug-i386.dll..vehdebug-x86_64.dll..speedhack-i386.dll..speedhack-x86_64.dll..luaclient-i386.dll..luaclient-x86_64.dll..d3dhook.dll..d3dhook64.dll..ced3d9hook.dll..ced3d9hook64.dll..ced3d10hook.dll..ced3d10hook64.dll..ced3d11hook.dll..ced3d11hook64.dll..luaclient-

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\How to add languages.txt (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1767
                                                                                                                                                                                                                                            Entropy (8bit):4.60229123925247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:vWKOiRBBMn0KciKvm/QRQY0cCu9llVyZVkFNS5Ns:ZqsRWQb91/NS5Ns
                                                                                                                                                                                                                                            MD5:05E8F84A134363796895E8AB8089619A
                                                                                                                                                                                                                                            SHA1:D6925DDDE83B117D7310C4A257DD9EE444245612
                                                                                                                                                                                                                                            SHA-256:D8462C8704A83973632D5F38D36F7852BF78D8A81C43BBC2F5AC8FF3A4D8B658
                                                                                                                                                                                                                                            SHA-512:C63F273EDB9411AA15F6B0C94C5FDE7189A33DCBD50141BB85D3BD31A4A009B1E5F6CF93E10A4300A39F0431452C49070C37D5907965CE49CCB4CED4BFB70EBA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:create a language folder for your country (appropriate folder names are in the format of: en_US, nl_NL, ru_RU, etc...)..copy the .po files to the appropriate folder and then start editing ......Order of picking:.. if there is a cheatengine.po it will pick that, else cheatengine-x86_64.po and if that fails cheatengine-i386.po.. the 32-bit version can work perfectly fine with the 64-bit po.... Same for the tutorial......By default it picks the system language, but you can overide this by adding --LANG langstr or -l langstr to the parameters of Cheat Engine......editing po files...There are some po editing tools but you can also do it by hand..msgid contains the original string and msgstr contains the translated string...If msgstr is empty the original string will be shown....Certain strings are not present in the cheatengine.po file, but are present in lclstrconsts.po..The lclstrconsts.po file belongs to the LCL that the Cheat Engine GUI is build upon......Custom name for your transla

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\Java.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4485
                                                                                                                                                                                                                                            Entropy (8bit):4.847226854261297
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:IAK8957xHV03E5IDRH3Y8LUHPop+1dpmq3W2D40AujDHZYnAd9BaJ5:IqJ6EURIvOScBj01ZYnAzcH
                                                                                                                                                                                                                                            MD5:FC3504DD7281F478FA29530B4BDBC3D8
                                                                                                                                                                                                                                            SHA1:084D65DF95350C869D5DDEFB53C0436236FCF4C7
                                                                                                                                                                                                                                            SHA-256:162E0DE680FE0E8BCABB09F9D51259A1CE5F83B481BBFC32DE055E0C7CEFC33C
                                                                                                                                                                                                                                            SHA-512:FCDB7F5244DD8EFB6448BA15B621B49D5F24E0AD79A02C5F1F91664A9CDA2C548540961075FA819DCF7459602EFCC41C34670B32B0A16A6639E4598BF76BDA28
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: java-AAF..msgid "Auto assembler failed:"..msgstr ""....#: java-JEST..msgid "Java:eventserver terminated"..msgstr ""....#: java-JD..msgid "Java:Disconnected"..msgstr ""....#: java-JUER..msgid "Java:Unexpected event received"..msgstr ""....#: java-JEHT..msgid "Java:Event handler terminating"..msgstr ""....#: java-IJS..msgid "Invalid java signature"..msgstr ""....#: java-ARTANS..msgid "Array return types are not supported"..msgstr ""....#: java-PCDNM..msgid "Parameter count does not match"..msgstr ""....#: java-SWNS..msgid "Scantype was not set"..msgstr ""....#: java-Class..msgid "Class"..msgstr ""....#: java-Method..msgid "Method"..msgstr ""....#: java-Position..msgid "Position"..msgstr ""....#: java-MI..msgid "More info %s.%s(%d)"..msgstr ""....#: java-TDMATGV..msgid "The following methods accessed the given variable"..msgstr ""....#: java-results..msgid "results"..msgstr ""....#: java-OWWTJAILAS..msgid "java_find_what_writes only works when the jvmti agent is launched at start"..msg

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\SaveSessions.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):284
                                                                                                                                                                                                                                            Entropy (8bit):4.462768521135749
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:InTTzQ9vrJXm6D9AMXqnTzQ3Lz2oVX2aT5WnpXMZBhnpl:InT4O6D+Nn43PYaTVZ/
                                                                                                                                                                                                                                            MD5:684C9B4A3EE100B044C2BFB0EDD64919
                                                                                                                                                                                                                                            SHA1:9A8AC81C35F3EA58E97D3A083E3FECA83F01A0AA
                                                                                                                                                                                                                                            SHA-256:E4283FFAB471763663C189527C805C6985B92C252074727A41E304839C45AB91
                                                                                                                                                                                                                                            SHA-512:B15DCC949F588C612F3A92D0DEFED4CEA025C86ED4C27E8B3BDF52A218CDE913B89FF4079A419D068CA4EA2793534246A4D17EB25BA4A45D6F5A19639B300E37
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: SS-OaPF..msgid "Open a process first"..msgstr ""....#: SS-CESF..msgid "Cheat Engine Scan files"..msgstr ""....#: SS-OaPFDaS..msgid "Open a process first and do a scan"..msgstr ""....#: SS-SSS..msgid "Save scan session"..msgstr ""....#: SS-LSS..msgid "Load scan session"..msgstr ""

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\Tutorial-x86_64.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with very long lines (516), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):28896
                                                                                                                                                                                                                                            Entropy (8bit):4.8485599257299
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:jObDfIDkxEV6uOssgT33Nm61682jD1gSuKlRr0ol425ESJoD/LmdSHdd+drGbzMz:jiDfISv9k+tjYo0ol4YOCU9d2mzMaq
                                                                                                                                                                                                                                            MD5:30F95F6B621C5619BCF23592F634DFE7
                                                                                                                                                                                                                                            SHA1:824308A98923960760C0E37C8411091A40A42ED0
                                                                                                                                                                                                                                            SHA-256:E10D0B9DF7A59FC657AAA4355B884E7905FDC009612D39C89CB8561CF6049C18
                                                                                                                                                                                                                                            SHA-512:70934880CD569D4B8179F1420EF7429571F92548B573C8D83A8FAE789D85EA7C79B59E9A4667515BEF03EA186B81961893E522743D7A1F19A8EDD755D85B1228
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: tform1.btnok.caption..msgctxt "tform1.btnok.caption"..msgid "OK"..msgstr ""....#: tform1.button1.caption..msgctxt "tform1.button1.caption"..msgid "Next"..msgstr ""....#: tform1.caption..msgid "Cheat Engine Tutorial v3.4"..msgstr ""....#: tform1.edtpassword.hint..msgid "Use this to go imeadiatly to the step you want to try"..msgstr ""....#: tform1.edtpassword.text..msgid "090453"..msgstr ""....#: tform1.label1.caption..msgid "Password"..msgstr ""....#: tform10.button3.caption..msgid "Restart game"..msgstr ""....#: tform10.button4.caption..msgctxt "tform10.button4.caption"..msgid "Attack"..msgstr ""....#: tform10.button5.caption..msgctxt "tform10.button5.caption"..msgid "Attack"..msgstr ""....#: tform10.button6.caption..msgctxt "tform10.button6.caption"..msgid "Restart game and autoplay"..msgstr ""....#: tform10.button7.caption..msgctxt "tform10.button7.caption"..msgid "Attack"..msgstr ""....#: tform10.button8.caption..msgc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\VersionCheck.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):772
                                                                                                                                                                                                                                            Entropy (8bit):5.014428182186076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:IxYsI/YaxIBqhAsSIebWFIIcGnIAqWIeyIwZ5GmyI48DqVpDYybxIqUcO:IxBaQDsabWFup5zvD6DnbbO
                                                                                                                                                                                                                                            MD5:F67F26AECAC8F570A9EB02F0929ABAC5
                                                                                                                                                                                                                                            SHA1:43DB5011E744CFD43E4446B73BEC1178FA55C80D
                                                                                                                                                                                                                                            SHA-256:A31280A8CF98B30556BD99B25781D09686E67D85C3EB89D42584832A18962AD0
                                                                                                                                                                                                                                            SHA-512:DA06E6DFCC7DCA2E9F6017D316B2EC685135C6FD0F5C4F0C83960D3C4A3C503CF9FF205D619BDA77987A36E789E78804FDDD7A9DF84562789D2CFE42A7EE6E0C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: VC-U2CVICNEL..msgid "Unable to check version (Invalid content, not enough lines)"..msgstr ""....#: VC-U2CVIC..msgid "Unable to check version (Invalid content)"..msgstr ""......#: VC-CFNV..msgid "Check for new version"..msgstr ""....#: VC-NCA..msgid "Cheat Engine %s is available at www.cheatengine.org. Go there now?"..msgstr ""......#: VC-UP2D..msgid "You are up to date. The latest version is %s"..msgstr ""....#: VC-WTF..msgid "Unable to check version (Can't connect)"..msgstr ""....#: VC-UPDATETO..msgid "Update to %s"..msgstr ""....#: VC-UPDATETO..msgid "In how many days should I notify you again?"..msgstr ""....#: VC-SETTINGS-TEXT..msgid "Check for updates when Cheat Engine starts"..msgstr ""......#: VC-INTERVAL..msgid "Interval(days):"..msgstr ""............

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\cheatengine-x86_64.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with very long lines (332), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):453577
                                                                                                                                                                                                                                            Entropy (8bit):4.778949128243926
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:gZ44KYZGVK44SCYJs6xj6JnhYpMzqtBtnIgJ:o44Ki4FCYJHpMABtnr
                                                                                                                                                                                                                                            MD5:3260EDC88460A983A6796D746CFF2815
                                                                                                                                                                                                                                            SHA1:444DF138C1FF161D4CDE2FC134403F11D6294528
                                                                                                                                                                                                                                            SHA-256:C6414831A61EFB7872E4FA41C65646413A57EED6ECFCA307AFBF1D04FD5B5432
                                                                                                                                                                                                                                            SHA-512:28C4BD49669ED330FB9BE5D34016E7D557EA964F17E8B6B39700216A4698F3131AB6A42FC1C2065056CAF709A2A63FF630CDA3EC53F76C3768E62CB0D7E8D743
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: aboutunit.rsareyousureyouwanttolaunchdbvm..msgid "Are you sure you want to launch DBVM? You seem to be running in 32-bit, so don't really need it that badly (Except for ultimap and cloaked operations)"..msgstr ""....#: aboutunit.rsdidyoureallythinkyoudfindaneastereggbydoingthiswel..msgid "Did you really think you'd find an easter egg by doing this? Well, you know what? You where right!"..msgstr ""....#: aboutunit.rslaunchdbvmwasnotassigned..msgid "launchdbvm was not assigned"..msgstr ""....#: aboutunit.rsthismeansthatyourecurrentlynotrunningdbvm..msgid "This means that you're currently not running dbvm, but that your system is capable of running it"..msgstr ""....#: aboutunit.rsthismeansthatyoursystemisrunningdbvm..msgid "This means that your system is running dbvm. This means ce will make use of some advanced tools that are otherwise unavailable"..msgstr ""....#: aboutunit.rsthismeansthatyouwillneedanewcpuinteltobeableto

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-2D1UK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1044
                                                                                                                                                                                                                                            Entropy (8bit):4.607911901797074
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:SyKwrQRrYuB24kEiVmSoUiEY0M6zrvLB/Nt:f224kfVLNNt
                                                                                                                                                                                                                                            MD5:9924B578270AB864E800BF38B2FA65BE
                                                                                                                                                                                                                                            SHA1:65174EA0E3FA382BBCF7DEEB2E5F5C74AA0E51F4
                                                                                                                                                                                                                                            SHA-256:16EC4573AE731BC32397874599F2E2FED68BAEE932F23DA6DDDDCE99917B8D70
                                                                                                                                                                                                                                            SHA-512:C27B43A3944BF9A9B6A6E88FEAF0BA40C84364580015420075EF89131A23586B7FF2908A2992CA0FFC7BC928ABA12A0B111260A592A479DDF97B46375D772714
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.#: patchscan-nave..msgid "Not a valid executable"..msgstr ""....#: patchscan-navwe..msgid "Not a valid windows executable"..msgstr ""....#: patchscan-ttomicns..msgid "This type of module is currently not supported"..msgstr ""....#: patchscan-ce..msgid "Compare error. "..msgstr ""....#: patchscan-ml..msgid "Module List"..msgstr ""....#: patchscan-stmtsfp..msgid "Select the modules to scan for patches. Hold shift/ctrl to select multiple modules"..msgstr ""....#: patchscan-ok..msgid " OK "..msgstr ""....#: patchscan-cancel..msgid "Cancel"..msgstr ""....#: patchscan-scanning..msgid "Scanning: %s"..msgstr ""....#: patchscan-ei..msgid "Error in "..msgstr ""....#: patchscan-pl..msgid "Patch list"..msgstr ""....#: patchscan-address..msgid "Address"..msgstr ""....#: patchscan-original..msgid "Original"..msgstr ""....#: patchscan-patched..msgid "Patched"..msgstr ""....#: patchscan-rwo..msgid "Restore with original"..msgstr ""....#: patchscan-rp..msgid "Reapply patch"..msgstr ""....#: patchs

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-692Q1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1767
                                                                                                                                                                                                                                            Entropy (8bit):4.60229123925247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:vWKOiRBBMn0KciKvm/QRQY0cCu9llVyZVkFNS5Ns:ZqsRWQb91/NS5Ns
                                                                                                                                                                                                                                            MD5:05E8F84A134363796895E8AB8089619A
                                                                                                                                                                                                                                            SHA1:D6925DDDE83B117D7310C4A257DD9EE444245612
                                                                                                                                                                                                                                            SHA-256:D8462C8704A83973632D5F38D36F7852BF78D8A81C43BBC2F5AC8FF3A4D8B658
                                                                                                                                                                                                                                            SHA-512:C63F273EDB9411AA15F6B0C94C5FDE7189A33DCBD50141BB85D3BD31A4A009B1E5F6CF93E10A4300A39F0431452C49070C37D5907965CE49CCB4CED4BFB70EBA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:create a language folder for your country (appropriate folder names are in the format of: en_US, nl_NL, ru_RU, etc...)..copy the .po files to the appropriate folder and then start editing ......Order of picking:.. if there is a cheatengine.po it will pick that, else cheatengine-x86_64.po and if that fails cheatengine-i386.po.. the 32-bit version can work perfectly fine with the 64-bit po.... Same for the tutorial......By default it picks the system language, but you can overide this by adding --LANG langstr or -l langstr to the parameters of Cheat Engine......editing po files...There are some po editing tools but you can also do it by hand..msgid contains the original string and msgstr contains the translated string...If msgstr is empty the original string will be shown....Certain strings are not present in the cheatengine.po file, but are present in lclstrconsts.po..The lclstrconsts.po file belongs to the LCL that the Cheat Engine GUI is build upon......Custom name for your transla

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-8TGUU.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):284
                                                                                                                                                                                                                                            Entropy (8bit):4.462768521135749
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:InTTzQ9vrJXm6D9AMXqnTzQ3Lz2oVX2aT5WnpXMZBhnpl:InT4O6D+Nn43PYaTVZ/
                                                                                                                                                                                                                                            MD5:684C9B4A3EE100B044C2BFB0EDD64919
                                                                                                                                                                                                                                            SHA1:9A8AC81C35F3EA58E97D3A083E3FECA83F01A0AA
                                                                                                                                                                                                                                            SHA-256:E4283FFAB471763663C189527C805C6985B92C252074727A41E304839C45AB91
                                                                                                                                                                                                                                            SHA-512:B15DCC949F588C612F3A92D0DEFED4CEA025C86ED4C27E8B3BDF52A218CDE913B89FF4079A419D068CA4EA2793534246A4D17EB25BA4A45D6F5A19639B300E37
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: SS-OaPF..msgid "Open a process first"..msgstr ""....#: SS-CESF..msgid "Cheat Engine Scan files"..msgstr ""....#: SS-OaPFDaS..msgid "Open a process first and do a scan"..msgstr ""....#: SS-SSS..msgid "Save scan session"..msgstr ""....#: SS-LSS..msgid "Load scan session"..msgstr ""

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-AVJBR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):772
                                                                                                                                                                                                                                            Entropy (8bit):5.014428182186076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:IxYsI/YaxIBqhAsSIebWFIIcGnIAqWIeyIwZ5GmyI48DqVpDYybxIqUcO:IxBaQDsabWFup5zvD6DnbbO
                                                                                                                                                                                                                                            MD5:F67F26AECAC8F570A9EB02F0929ABAC5
                                                                                                                                                                                                                                            SHA1:43DB5011E744CFD43E4446B73BEC1178FA55C80D
                                                                                                                                                                                                                                            SHA-256:A31280A8CF98B30556BD99B25781D09686E67D85C3EB89D42584832A18962AD0
                                                                                                                                                                                                                                            SHA-512:DA06E6DFCC7DCA2E9F6017D316B2EC685135C6FD0F5C4F0C83960D3C4A3C503CF9FF205D619BDA77987A36E789E78804FDDD7A9DF84562789D2CFE42A7EE6E0C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: VC-U2CVICNEL..msgid "Unable to check version (Invalid content, not enough lines)"..msgstr ""....#: VC-U2CVIC..msgid "Unable to check version (Invalid content)"..msgstr ""......#: VC-CFNV..msgid "Check for new version"..msgstr ""....#: VC-NCA..msgid "Cheat Engine %s is available at www.cheatengine.org. Go there now?"..msgstr ""......#: VC-UP2D..msgid "You are up to date. The latest version is %s"..msgstr ""....#: VC-WTF..msgid "Unable to check version (Can't connect)"..msgstr ""....#: VC-UPDATETO..msgid "Update to %s"..msgstr ""....#: VC-UPDATETO..msgid "In how many days should I notify you again?"..msgstr ""....#: VC-SETTINGS-TEXT..msgid "Check for updates when Cheat Engine starts"..msgstr ""......#: VC-INTERVAL..msgid "Interval(days):"..msgstr ""............

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-CFLPE.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2438
                                                                                                                                                                                                                                            Entropy (8bit):4.816958401157341
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:InNN5uwDdugIWruZxDNj9kospRbxaq2lSZeu2H7phQpo1TMAFpRvbubzb/PdQQiN:InJbxugIWSPNj9kospFxV2lSZeZH7/nR
                                                                                                                                                                                                                                            MD5:5194E6AAC00716CEB7498A8263ABDB03
                                                                                                                                                                                                                                            SHA1:D249CC96E60A36B0B9DA99D69903BD81D3F32C8F
                                                                                                                                                                                                                                            SHA-256:3842AF13D8462A02E6F3A8B3B5C3079EAF1081B030415287F67F10FB6F622109
                                                                                                                                                                                                                                            SHA-512:A7F89289E3A8827367E827A29224FEC0CC9D8699A082D592F372E13FB413BFD8B837A8313AD6530FA4BB6409E06A85BDBA890CE00B00DC7FF3FCF873F7F0EF4F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: monoscript-FITM..msgid "Failure injecting the MonoDatacollector dll"..msgstr ""....#: monoscript-DYWTL..msgid "Do you wish to let the mono extention figure out the name and start address? If it's not a proper object this may crash the target."..msgstr ""....#: monoscript-IO..msgid "Instances of "..msgstr ""....#: monoscript-WTAJG..msgid "Warning: These are just guesses. Validate them yourself"..msgstr ""....#: monoscript-AN..msgid "address==nil"..msgstr ""....#: monoscript-Invoke..msgid "Invoke "..msgstr ""....#: monoscript-IA..msgid "Instance address"..msgstr ""....#: monoscript-PW..msgid "<Please wait...>"..msgstr ""....#: monoscript-Parameters..msgid "Parameters"..msgstr ""....#: monoscript-OK..msgid "OK"..msgstr ""....#: monoscript-Cancel..msgid "Cancel"..msgstr ""....#: monoscript-Parameter..msgid "parameter "..msgstr ""....#: monoscript-INAVA..msgid " is not a valid address"..msgstr ""....#: monoscript-INAVV..msgid "is not a valid value"..msgstr ""....#: monoscript-IFT..msgid

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-DA6UQ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3133
                                                                                                                                                                                                                                            Entropy (8bit):4.680373003343051
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:IhHlcWZkIteIVcqUcTNqcNPnVSYQr6sbYuwGW:Ircee/qUpcV5QOsEuwGW
                                                                                                                                                                                                                                            MD5:5D6D7A6A5ADC10BB638B085FA47A5A00
                                                                                                                                                                                                                                            SHA1:C4A2D207F3002767844F1B6130F2DDAF6F45A7F9
                                                                                                                                                                                                                                            SHA-256:37D28D4690BD14D15D9E2198610C7F7DED33DC7D118A1B8BDC2C32FFD0D92C74
                                                                                                                                                                                                                                            SHA-512:8DC87E314AFEE056F7D6D384F823F71DD5D3802CD0ADEEEAE5FF856D1E9068A8E981E1F588733C8948FB1B824285F7F093B6CB35DAC872327D645CA3912E2A5B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: pseudocodediagram-file..msgid "File"..msgstr ""....#: pseudocodediagram-lff..msgid "Load from file"..msgstr ""....#: pseudocodediagram-stfywto..msgid "Select the file you wish to open"..msgstr ""....#: pseudocodediagram-dfcc..msgid "Diagram files (*.CEDIAG )|*.CEDIAG"..msgstr ""....#: pseudocodediagram-stf..msgid "Save to file"..msgstr ""....#: pseudocodediagram-fitfywtstda..msgid "Fill in the filename you wish to save this diagram as"..msgstr ""....#: pseudocodediagram-sdti..msgid "Save diagram to image"..msgstr ""....#: pseudocodediagram-fitfywtstdi..msgid "Fill in the filename you wish to save this diagram image"..msgstr ""....#: pseudocodediagram-pfpp..msgid "PNG files (*.PNG )|*.PNG"..msgstr ""....#: pseudocodediagram-close..msgid "Close"..msgstr ""....#: pseudocodediagram-display..msgid "Display"..msgstr ""....#: pseudocodediagram-spfu2oc..msgid "Show path from Ultimap1/2 or Codefilter"..msgstr ""....#: pseudocodediagram-spftw..msgid "Show path from tracer window"..msgstr ""..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-GCVRT.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4485
                                                                                                                                                                                                                                            Entropy (8bit):4.847226854261297
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:IAK8957xHV03E5IDRH3Y8LUHPop+1dpmq3W2D40AujDHZYnAd9BaJ5:IqJ6EURIvOScBj01ZYnAzcH
                                                                                                                                                                                                                                            MD5:FC3504DD7281F478FA29530B4BDBC3D8
                                                                                                                                                                                                                                            SHA1:084D65DF95350C869D5DDEFB53C0436236FCF4C7
                                                                                                                                                                                                                                            SHA-256:162E0DE680FE0E8BCABB09F9D51259A1CE5F83B481BBFC32DE055E0C7CEFC33C
                                                                                                                                                                                                                                            SHA-512:FCDB7F5244DD8EFB6448BA15B621B49D5F24E0AD79A02C5F1F91664A9CDA2C548540961075FA819DCF7459602EFCC41C34670B32B0A16A6639E4598BF76BDA28
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: java-AAF..msgid "Auto assembler failed:"..msgstr ""....#: java-JEST..msgid "Java:eventserver terminated"..msgstr ""....#: java-JD..msgid "Java:Disconnected"..msgstr ""....#: java-JUER..msgid "Java:Unexpected event received"..msgstr ""....#: java-JEHT..msgid "Java:Event handler terminating"..msgstr ""....#: java-IJS..msgid "Invalid java signature"..msgstr ""....#: java-ARTANS..msgid "Array return types are not supported"..msgstr ""....#: java-PCDNM..msgid "Parameter count does not match"..msgstr ""....#: java-SWNS..msgid "Scantype was not set"..msgstr ""....#: java-Class..msgid "Class"..msgstr ""....#: java-Method..msgid "Method"..msgstr ""....#: java-Position..msgid "Position"..msgstr ""....#: java-MI..msgid "More info %s.%s(%d)"..msgstr ""....#: java-TDMATGV..msgid "The following methods accessed the given variable"..msgstr ""....#: java-results..msgid "results"..msgstr ""....#: java-OWWTJAILAS..msgid "java_find_what_writes only works when the jvmti agent is launched at start"..msg

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-IDTKR.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with very long lines (332), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):453577
                                                                                                                                                                                                                                            Entropy (8bit):4.778949128243926
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:gZ44KYZGVK44SCYJs6xj6JnhYpMzqtBtnIgJ:o44Ki4FCYJHpMABtnr
                                                                                                                                                                                                                                            MD5:3260EDC88460A983A6796D746CFF2815
                                                                                                                                                                                                                                            SHA1:444DF138C1FF161D4CDE2FC134403F11D6294528
                                                                                                                                                                                                                                            SHA-256:C6414831A61EFB7872E4FA41C65646413A57EED6ECFCA307AFBF1D04FD5B5432
                                                                                                                                                                                                                                            SHA-512:28C4BD49669ED330FB9BE5D34016E7D557EA964F17E8B6B39700216A4698F3131AB6A42FC1C2065056CAF709A2A63FF630CDA3EC53F76C3768E62CB0D7E8D743
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: aboutunit.rsareyousureyouwanttolaunchdbvm..msgid "Are you sure you want to launch DBVM? You seem to be running in 32-bit, so don't really need it that badly (Except for ultimap and cloaked operations)"..msgstr ""....#: aboutunit.rsdidyoureallythinkyoudfindaneastereggbydoingthiswel..msgid "Did you really think you'd find an easter egg by doing this? Well, you know what? You where right!"..msgstr ""....#: aboutunit.rslaunchdbvmwasnotassigned..msgid "launchdbvm was not assigned"..msgstr ""....#: aboutunit.rsthismeansthatyourecurrentlynotrunningdbvm..msgid "This means that you're currently not running dbvm, but that your system is capable of running it"..msgstr ""....#: aboutunit.rsthismeansthatyoursystemisrunningdbvm..msgid "This means that your system is running dbvm. This means ce will make use of some advanced tools that are otherwise unavailable"..msgstr ""....#: aboutunit.rsthismeansthatyouwillneedanewcpuinteltobeableto

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-QONLV.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with very long lines (407), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):31373
                                                                                                                                                                                                                                            Entropy (8bit):4.738121487849168
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gyw0FrKFidHPeeMV6uSsX5Ipahgjmg7vxAP7:gyFKFwPume5Ipaum7
                                                                                                                                                                                                                                            MD5:B16C41734CCB91D59D6EFD720B8CC5C2
                                                                                                                                                                                                                                            SHA1:894641756D69268F40A97A659E7FEC6422424D74
                                                                                                                                                                                                                                            SHA-256:D4940DFF786E4B3C2DFE9B0518B64B91A2B8C0F0B8185E2B4CF7784E615F20A1
                                                                                                                                                                                                                                            SHA-512:C38458F79B2A651065C31602BBC9C230C49E1567254A5D044E9A94FE9DC63B19B0EABFE7446688E58F843FEB65CF290453B3E8BFB800EEBF1459A4134C0CFBB0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:msgid ""..msgstr "".."MIME-Version: 1.0\n".."Content-Type: text/plain; charset=UTF-8\n".."Content-Transfer-Encoding: 8bit\n"....#: lclstrconsts.hhshelpbrowsernotexecutable..msgid "Browser %s%s%s not executable."..msgstr ""....#: lclstrconsts.hhshelpbrowsernotfound..msgid "Browser %s%s%s not found."..msgstr ""....#: lclstrconsts.hhshelperrorwhileexecuting..msgid "Error while executing %s%s%s:%s%s"..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfound..msgid "Unable to find a HTML browser."..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfoundpleasedefineoneinhelpconfigurehe..msgid "No HTML Browser found.%sPlease define one in Environment -> Options -> Help -> Help Options"..msgstr ""....#: lclstrconsts.hhshelpthehelpdatabasewasunabletofindfile..msgid "The help database %s%s%s was unable to find file %s%s%s."..msgstr ""....#: lclstrconsts.hhshelpthemacrosinbrowserparamswillbereplacedbytheurl..msgid "The macro %s in BrowserParams will be replaced by the URL."..msgstr ""....#: lclstrco

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-TT78L.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with very long lines (516), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):28896
                                                                                                                                                                                                                                            Entropy (8bit):4.8485599257299
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:jObDfIDkxEV6uOssgT33Nm61682jD1gSuKlRr0ol425ESJoD/LmdSHdd+drGbzMz:jiDfISv9k+tjYo0ol4YOCU9d2mzMaq
                                                                                                                                                                                                                                            MD5:30F95F6B621C5619BCF23592F634DFE7
                                                                                                                                                                                                                                            SHA1:824308A98923960760C0E37C8411091A40A42ED0
                                                                                                                                                                                                                                            SHA-256:E10D0B9DF7A59FC657AAA4355B884E7905FDC009612D39C89CB8561CF6049C18
                                                                                                                                                                                                                                            SHA-512:70934880CD569D4B8179F1420EF7429571F92548B573C8D83A8FAE789D85EA7C79B59E9A4667515BEF03EA186B81961893E522743D7A1F19A8EDD755D85B1228
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: tform1.btnok.caption..msgctxt "tform1.btnok.caption"..msgid "OK"..msgstr ""....#: tform1.button1.caption..msgctxt "tform1.button1.caption"..msgid "Next"..msgstr ""....#: tform1.caption..msgid "Cheat Engine Tutorial v3.4"..msgstr ""....#: tform1.edtpassword.hint..msgid "Use this to go imeadiatly to the step you want to try"..msgstr ""....#: tform1.edtpassword.text..msgid "090453"..msgstr ""....#: tform1.label1.caption..msgid "Password"..msgstr ""....#: tform10.button3.caption..msgid "Restart game"..msgstr ""....#: tform10.button4.caption..msgctxt "tform10.button4.caption"..msgid "Attack"..msgstr ""....#: tform10.button5.caption..msgctxt "tform10.button5.caption"..msgid "Attack"..msgstr ""....#: tform10.button6.caption..msgctxt "tform10.button6.caption"..msgid "Restart game and autoplay"..msgstr ""....#: tform10.button7.caption..msgctxt "tform10.button7.caption"..msgid "Attack"..msgstr ""....#: tform10.button8.caption..msgc

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\is-UHV8B.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):283
                                                                                                                                                                                                                                            Entropy (8bit):4.58883566118718
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:dc1MUMt3Y+j2ZSWF1iyFQFNHNTSoaOiXkq3cM8TcKDymRKCFWp4aq32vn:dc2LYKefEyBO/bMnE2zFv
                                                                                                                                                                                                                                            MD5:AF5ED8F4FE5370516403AE39200F5A4F
                                                                                                                                                                                                                                            SHA1:9299E9998A0605182683A58A5A6AB01A9B9BC037
                                                                                                                                                                                                                                            SHA-256:4AA4F0B75548D45C81D8E876E2DB1C74BDDFD64091F102706D729B50A7AF53A5
                                                                                                                                                                                                                                            SHA-512:F070049A2FAE3223861424E7FE79CBAE6601C9BEE6A56FADDE4485AD3C597DC1F3687E720177AB28564A1FAAB52B6679E9315F74327D02AA1FB31E7B8233A80F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:;If the --LANG parameter OR the LANG environment variable are not set and this inifile..;is present in this folder it will be used to pick the language...[Language]..;If preferedLanguage is kept empty CE will choose the language of your operating system instead..PreferedLanguage=*..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\language.ini (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):283
                                                                                                                                                                                                                                            Entropy (8bit):4.58883566118718
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:dc1MUMt3Y+j2ZSWF1iyFQFNHNTSoaOiXkq3cM8TcKDymRKCFWp4aq32vn:dc2LYKefEyBO/bMnE2zFv
                                                                                                                                                                                                                                            MD5:AF5ED8F4FE5370516403AE39200F5A4F
                                                                                                                                                                                                                                            SHA1:9299E9998A0605182683A58A5A6AB01A9B9BC037
                                                                                                                                                                                                                                            SHA-256:4AA4F0B75548D45C81D8E876E2DB1C74BDDFD64091F102706D729B50A7AF53A5
                                                                                                                                                                                                                                            SHA-512:F070049A2FAE3223861424E7FE79CBAE6601C9BEE6A56FADDE4485AD3C597DC1F3687E720177AB28564A1FAAB52B6679E9315F74327D02AA1FB31E7B8233A80F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:;If the --LANG parameter OR the LANG environment variable are not set and this inifile..;is present in this folder it will be used to pick the language...[Language]..;If preferedLanguage is kept empty CE will choose the language of your operating system instead..PreferedLanguage=*..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\lclstrconsts.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with very long lines (407), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):31373
                                                                                                                                                                                                                                            Entropy (8bit):4.738121487849168
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gyw0FrKFidHPeeMV6uSsX5Ipahgjmg7vxAP7:gyFKFwPume5Ipaum7
                                                                                                                                                                                                                                            MD5:B16C41734CCB91D59D6EFD720B8CC5C2
                                                                                                                                                                                                                                            SHA1:894641756D69268F40A97A659E7FEC6422424D74
                                                                                                                                                                                                                                            SHA-256:D4940DFF786E4B3C2DFE9B0518B64B91A2B8C0F0B8185E2B4CF7784E615F20A1
                                                                                                                                                                                                                                            SHA-512:C38458F79B2A651065C31602BBC9C230C49E1567254A5D044E9A94FE9DC63B19B0EABFE7446688E58F843FEB65CF290453B3E8BFB800EEBF1459A4134C0CFBB0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:msgid ""..msgstr "".."MIME-Version: 1.0\n".."Content-Type: text/plain; charset=UTF-8\n".."Content-Transfer-Encoding: 8bit\n"....#: lclstrconsts.hhshelpbrowsernotexecutable..msgid "Browser %s%s%s not executable."..msgstr ""....#: lclstrconsts.hhshelpbrowsernotfound..msgid "Browser %s%s%s not found."..msgstr ""....#: lclstrconsts.hhshelperrorwhileexecuting..msgid "Error while executing %s%s%s:%s%s"..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfound..msgid "Unable to find a HTML browser."..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfoundpleasedefineoneinhelpconfigurehe..msgid "No HTML Browser found.%sPlease define one in Environment -> Options -> Help -> Help Options"..msgstr ""....#: lclstrconsts.hhshelpthehelpdatabasewasunabletofindfile..msgid "The help database %s%s%s was unable to find file %s%s%s."..msgstr ""....#: lclstrconsts.hhshelpthemacrosinbrowserparamswillbereplacedbytheurl..msgid "The macro %s in BrowserParams will be replaced by the URL."..msgstr ""....#: lclstrco

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\monoscript.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2438
                                                                                                                                                                                                                                            Entropy (8bit):4.816958401157341
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:InNN5uwDdugIWruZxDNj9kospRbxaq2lSZeu2H7phQpo1TMAFpRvbubzb/PdQQiN:InJbxugIWSPNj9kospFxV2lSZeZH7/nR
                                                                                                                                                                                                                                            MD5:5194E6AAC00716CEB7498A8263ABDB03
                                                                                                                                                                                                                                            SHA1:D249CC96E60A36B0B9DA99D69903BD81D3F32C8F
                                                                                                                                                                                                                                            SHA-256:3842AF13D8462A02E6F3A8B3B5C3079EAF1081B030415287F67F10FB6F622109
                                                                                                                                                                                                                                            SHA-512:A7F89289E3A8827367E827A29224FEC0CC9D8699A082D592F372E13FB413BFD8B837A8313AD6530FA4BB6409E06A85BDBA890CE00B00DC7FF3FCF873F7F0EF4F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: monoscript-FITM..msgid "Failure injecting the MonoDatacollector dll"..msgstr ""....#: monoscript-DYWTL..msgid "Do you wish to let the mono extention figure out the name and start address? If it's not a proper object this may crash the target."..msgstr ""....#: monoscript-IO..msgid "Instances of "..msgstr ""....#: monoscript-WTAJG..msgid "Warning: These are just guesses. Validate them yourself"..msgstr ""....#: monoscript-AN..msgid "address==nil"..msgstr ""....#: monoscript-Invoke..msgid "Invoke "..msgstr ""....#: monoscript-IA..msgid "Instance address"..msgstr ""....#: monoscript-PW..msgid "<Please wait...>"..msgstr ""....#: monoscript-Parameters..msgid "Parameters"..msgstr ""....#: monoscript-OK..msgid "OK"..msgstr ""....#: monoscript-Cancel..msgid "Cancel"..msgstr ""....#: monoscript-Parameter..msgid "parameter "..msgstr ""....#: monoscript-INAVA..msgid " is not a valid address"..msgstr ""....#: monoscript-INAVV..msgid "is not a valid value"..msgstr ""....#: monoscript-IFT..msgid

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\patchscan.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1044
                                                                                                                                                                                                                                            Entropy (8bit):4.607911901797074
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:SyKwrQRrYuB24kEiVmSoUiEY0M6zrvLB/Nt:f224kfVLNNt
                                                                                                                                                                                                                                            MD5:9924B578270AB864E800BF38B2FA65BE
                                                                                                                                                                                                                                            SHA1:65174EA0E3FA382BBCF7DEEB2E5F5C74AA0E51F4
                                                                                                                                                                                                                                            SHA-256:16EC4573AE731BC32397874599F2E2FED68BAEE932F23DA6DDDDCE99917B8D70
                                                                                                                                                                                                                                            SHA-512:C27B43A3944BF9A9B6A6E88FEAF0BA40C84364580015420075EF89131A23586B7FF2908A2992CA0FFC7BC928ABA12A0B111260A592A479DDF97B46375D772714
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.#: patchscan-nave..msgid "Not a valid executable"..msgstr ""....#: patchscan-navwe..msgid "Not a valid windows executable"..msgstr ""....#: patchscan-ttomicns..msgid "This type of module is currently not supported"..msgstr ""....#: patchscan-ce..msgid "Compare error. "..msgstr ""....#: patchscan-ml..msgid "Module List"..msgstr ""....#: patchscan-stmtsfp..msgid "Select the modules to scan for patches. Hold shift/ctrl to select multiple modules"..msgstr ""....#: patchscan-ok..msgid " OK "..msgstr ""....#: patchscan-cancel..msgid "Cancel"..msgstr ""....#: patchscan-scanning..msgid "Scanning: %s"..msgstr ""....#: patchscan-ei..msgid "Error in "..msgstr ""....#: patchscan-pl..msgid "Patch list"..msgstr ""....#: patchscan-address..msgid "Address"..msgstr ""....#: patchscan-original..msgid "Original"..msgstr ""....#: patchscan-patched..msgid "Patched"..msgstr ""....#: patchscan-rwo..msgid "Restore with original"..msgstr ""....#: patchscan-rp..msgid "Reapply patch"..msgstr ""....#: patchs

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\languages\pseudocodediagram.po (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:GNU gettext message catalogue, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3133
                                                                                                                                                                                                                                            Entropy (8bit):4.680373003343051
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:IhHlcWZkIteIVcqUcTNqcNPnVSYQr6sbYuwGW:Ircee/qUpcV5QOsEuwGW
                                                                                                                                                                                                                                            MD5:5D6D7A6A5ADC10BB638B085FA47A5A00
                                                                                                                                                                                                                                            SHA1:C4A2D207F3002767844F1B6130F2DDAF6F45A7F9
                                                                                                                                                                                                                                            SHA-256:37D28D4690BD14D15D9E2198610C7F7DED33DC7D118A1B8BDC2C32FFD0D92C74
                                                                                                                                                                                                                                            SHA-512:8DC87E314AFEE056F7D6D384F823F71DD5D3802CD0ADEEEAE5FF856D1E9068A8E981E1F588733C8948FB1B824285F7F093B6CB35DAC872327D645CA3912E2A5B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:#: pseudocodediagram-file..msgid "File"..msgstr ""....#: pseudocodediagram-lff..msgid "Load from file"..msgstr ""....#: pseudocodediagram-stfywto..msgid "Select the file you wish to open"..msgstr ""....#: pseudocodediagram-dfcc..msgid "Diagram files (*.CEDIAG )|*.CEDIAG"..msgstr ""....#: pseudocodediagram-stf..msgid "Save to file"..msgstr ""....#: pseudocodediagram-fitfywtstda..msgid "Fill in the filename you wish to save this diagram as"..msgstr ""....#: pseudocodediagram-sdti..msgid "Save diagram to image"..msgstr ""....#: pseudocodediagram-fitfywtstdi..msgid "Fill in the filename you wish to save this diagram image"..msgstr ""....#: pseudocodediagram-pfpp..msgid "PNG files (*.PNG )|*.PNG"..msgstr ""....#: pseudocodediagram-close..msgid "Close"..msgstr ""....#: pseudocodediagram-display..msgid "Display"..msgstr ""....#: pseudocodediagram-spfu2oc..msgid "Show path from Ultimap1/2 or Codefilter"..msgstr ""....#: pseudocodediagram-spftw..msgid "Show path from tracer window"..msgstr ""..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\libipt-32.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):161688
                                                                                                                                                                                                                                            Entropy (8bit):6.832669552984183
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:K3uc99F6AOdjfTOZztxlGWGXLQbcpNk6FowD6QcEY7Xjl5hf8keDQa/c7usWjcd6:K3ukXTNGp7+6zaEY7Zf/a0ye3ZoOvKOS
                                                                                                                                                                                                                                            MD5:DF443813546ABCEF7F33DD9FC0C6070A
                                                                                                                                                                                                                                            SHA1:635D2D453D48382824E44DD1E59D5C54D735EE2C
                                                                                                                                                                                                                                            SHA-256:D14911C838620251F7F64C190B04BB8F4E762318CC763D993C9179376228D8CA
                                                                                                                                                                                                                                            SHA-512:9F9BEA9112D9DB9BCECFC8E4800B7E8032EFB240CBBDDAF26C133B4CE12D27B47DC4E90BC339C561714BC972F6E809B2EC9C9E1FACC6C223FBAC66B089A14C25
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..U~...~...~...s...^...s.#.i...s.......w.o.}...~...'....v..g....v .....s.'......v".....Rich~...........................PE..L....d.W...........!.........................................................p......w.....@................................. ...(....@...................g...P..(...p...8...........................h...@...............4............................text............................... ..`.rdata...T.......V..................@..@.data... =..........................@....rsrc........@......................@..@.reloc..(....P......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\libipt-64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):187288
                                                                                                                                                                                                                                            Entropy (8bit):6.46399109534477
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:XMTS4QqrM7BqUHEwXDVT6B8AF6aBBcFkLODeYJObCkEjOUkOG:XIQqrc7V5Trw6aBBcFk6CtbID4
                                                                                                                                                                                                                                            MD5:4A3B7C52EF32D936E3167EFC1E920AE6
                                                                                                                                                                                                                                            SHA1:D5D8DAA7A272547419132DDB6E666F7559DBAC04
                                                                                                                                                                                                                                            SHA-256:26EDE848DBA071EB76C0C0EF8E9D8AD1C53DFAB47CA9137ABC9D683032F06EBB
                                                                                                                                                                                                                                            SHA-512:36D7F8A0A749DE049A830CC8C8F0D3962D8DCE57B445F5F3C771A86DD11AAA10DA5F36F95E55D3DC90900E4DBDDD0DCC21052C53AA11F939DB691362C42E5312
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d../ .t| .t| .t|f.|..t|f.|_.t|f.|*.t|.B.|#.t| .u||.t|.#.|9.t|.#.|!.t|-.|!.t|.#.|!.t|Rich .t|................PE..d....d.W.........." ................t................................................f....`..........................................4.......:..(....................t...g..............8...........................p...p............................................text............................... ..`.rdata..(...........................@..@.data....K...P.......4..............@....pdata...............R..............@..@.rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\libiptlicense.txt (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1491
                                                                                                                                                                                                                                            Entropy (8bit):5.150461183336365
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:c3UnepmoqbOOrYFlrJYrYFIzLQ9Zonc432smXOkuEWRO632s3yOtTf1p13to+Zqh:xOOrYj2rYCzeqnc432sem32s3xtD13tQ
                                                                                                                                                                                                                                            MD5:1EE5923E90E9DB03EF80F6DA5C14FB7B
                                                                                                                                                                                                                                            SHA1:BCB456DB885C932605F4DCFFABBF771BC7CB5C41
                                                                                                                                                                                                                                            SHA-256:1A971954CD09C202E73E625329EE4DDF7291C7C0E155A1086DA7FAAC1957C94B
                                                                                                                                                                                                                                            SHA-512:8A008D4FAEE52F76A6C9024DE88963261730FA12EB54B0BE5FB80F8CC02CF7FEC0EFC126A209A646BE17D91B78FFC2E54BAAB7E346474BCFFFD92D3C942E959F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Copyright 2018 Alex Ionescu. All rights reserved.....Redistribution and use in source and binary forms, with or without modification, are permitted provided..that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this list of conditions and.. the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions.. and the following disclaimer in the documentation and/or other materials provided with the.. distribution.....THIS SOFTWARE IS PROVIDED BY ALEX IONESCU ``AS IS'' AND ANY EXPRESS OR IMPLIED..WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND..FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ALEX IONESCU..OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR..CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS..OR SERVICES; LOSS OF USE,

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\libmikmod32.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):308120
                                                                                                                                                                                                                                            Entropy (8bit):6.921402988579037
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:3QMsoykzuYV4SPaa/Gr+RBmRQ5wipE04CIcFw6eAwE5Sm1Q5jsV+XkO4qOT:3NJyTuxkC57IZEzGmT
                                                                                                                                                                                                                                            MD5:462322CC93E55016D5EA78B2B9823657
                                                                                                                                                                                                                                            SHA1:3E8E00B690A4370D6F2DFDCF730F2D3FDA4806A6
                                                                                                                                                                                                                                            SHA-256:AEDC048FCFEC594E7307E4730D850E5E0121820A76CA1A363F4A2E41D084F393
                                                                                                                                                                                                                                            SHA-512:A46E56130A8D1CA588D9935D98468543328B42492F1257157D2C7FD99AC341E8A22337AC2228AECF33A70913A7E7161B300BB458E1C07D5D0B94A7AA1DD72D79
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t.....q.q...y.W.P...y.i.b...y.V......D}.}...t...+....%R.\....%j.u...y.m.u....%h.u...Richt...........................PE..L...h.&V...........!.....p................................................................@.....................................d....P...............L...g...`..@E......8...............................@...............T............................text....o.......p.................. ..`.rdata...v.......x...t..............@..@.data....@..........................@....rsrc........P......................@..@.reloc..@E...`...F..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\libmikmod64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):339864
                                                                                                                                                                                                                                            Entropy (8bit):6.56829741282491
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:ZnVdQfxRaiC76I/wZGteu+WJrXeN6joNtMrvMl9u61s1JGTBHpMqdmgIIE5pY2B:jdsxs6I6k9MUoNt2vSs8KqdmgIIE/b
                                                                                                                                                                                                                                            MD5:A358DAE60F1C0F6A633F98B1E4D3E850
                                                                                                                                                                                                                                            SHA1:2016F1FB0F8000E515602498432951B7C5BC5ACA
                                                                                                                                                                                                                                            SHA-256:25C648CFDB4CDBBB13630ADC7C14F2BB556C98F5CD1DCBECAFFA91629D2D4A4C
                                                                                                                                                                                                                                            SHA-512:879B5E95CF7F06E105930724BBC6967B367417DCE390A15DE48BF5CE76CE2435EA4A59095AB67EEE5A05FA41126DDB984C2154ABA34B33FAC895A1CCC2D2A617
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.j...9...9...9..p9...9..V9...9..W9...9..h9...9K.|9...9...9...9#.S9...9#.k9...9.|l9...9#.i9...9Rich...9........PE..d...t.&V.........." .........J...............................................0............`..........................................h.......t..d...............\+.......g... ......@...8............................8..p............................................text............................... ..`.rdata..P...........................@..@.data....R......."...n..............@....pdata..\+.......,..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\lua53-32.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):464280
                                                                                                                                                                                                                                            Entropy (8bit):6.881353710429075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:dBj8paX8fQ/T/md4OASZAOLRwRai6wXGn+hfy:dxLrLmd4OA4L8DXGnmy
                                                                                                                                                                                                                                            MD5:AD3F33BAC8EADAB224ADAF4CF6D5B97A
                                                                                                                                                                                                                                            SHA1:6CCFB97236C5AD3B48A3EB7A113E3E297422E808
                                                                                                                                                                                                                                            SHA-256:58B206AB9A3D84FDAFB537B419F721ECDEADE489707DBAB227B043D5343DB369
                                                                                                                                                                                                                                            SHA-512:C319A1C3D0D90AFEFD27DC0379C79E38993490FFA14CB281F419BC94FDE5776CD7EAB54351C57F6EAEEBCACF7F965FA0B8A8DD67489E799FCD84D39393C62A3E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]..3...3...3..d...3..d....3..d....3...6...3...7...3...0...3.......3...2...3.<.;...3.<.3...3.<....3.<.1...3.Rich..3.................PE..L....v._...........!..... ...................0............................................@..........................c.......q..(........................g.......2...W..p............................X..@............0..h............................text...@........ .................. ..`.rdata...I...0...J...$..............@..@.data................n..............@....rsrc................x..............@..@.reloc...2.......4...z..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\lua53-64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):541592
                                                                                                                                                                                                                                            Entropy (8bit):6.56379573889746
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:FshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5T:hOL9J2L8E5VKKSuLGEhXGstCXoYkc7BV
                                                                                                                                                                                                                                            MD5:B7C9F1E7E640F1A034BE84AF86970D45
                                                                                                                                                                                                                                            SHA1:F795DC3D781B9578A96C92658B9F95806FC9BDDE
                                                                                                                                                                                                                                            SHA-256:6D0A06B90213F082CB98950890518C0F08B9FC16DBFAB34D400267CB6CDADEFF
                                                                                                                                                                                                                                            SHA-512:DA63992B68F1112C0D6B33E6004F38E85B3C3E251E0D5457CD63804A49C5AA05AA23249E0614DACAD4FEC28CA6EFDB5DDEE06DA5BFBFA07E21942976201079F3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.............q.R.....q.P.....q.Q.....y......y......y.......i0............Vx......Vx......Vx\.....Vx......Rich............PE..d....w._.........." .................:....................................... ......&.....`.........................................0f..p....t..(................Q.......g......\.......p............................................................................text............................... ..`.rdata..............................@..@.data...8............n..............@....pdata...Q.......R...|..............@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):202648
                                                                                                                                                                                                                                            Entropy (8bit):6.566120700945174
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:fr03mcDwt5b2+z615yQ7SLVTnyJYpgerOEmgsRBZnwO4oO8:fg3mrHb2+z615yQ7GnyOpFOEFKD2G
                                                                                                                                                                                                                                            MD5:9F50134C8BE9AF59F371F607A6DAA0B6
                                                                                                                                                                                                                                            SHA1:6584B98172CBC4916A7E5CA8D5788493F85F24A7
                                                                                                                                                                                                                                            SHA-256:DD07117ED80546F23D37F8023E992DE560A1F55A76D1EB6DFD9D55BAA5E3DAD6
                                                                                                                                                                                                                                            SHA-512:5CCAFA2B0E2D20034168EE9A79E8EFFF64F12F5247F6772815EF4CB9EE56F245A06B088247222C5A3789AE2DCEFADBC2C15DF4FF5196028857F92B9992B094E0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........d....*........... ...............................@......D...........................................P........................g.......#......................................................d............................text............................... ..`.data...d.... ......................@....rdata..,c...@...d..................@..@.bss.....*...............................CRT.................~..............@....idata..............................@....edata..............................@..@.reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):266648
                                                                                                                                                                                                                                            Entropy (8bit):6.017604835530295
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KK2iOI60nWU4NJ4twEywGLOJQbcOL9z32fY8iV1OQfkz5w4Q7hk1D2oOyPOP:KKu0WU4J0w6xJkBAY8i7fkaThkA4g
                                                                                                                                                                                                                                            MD5:DD71848B5BBD150E22E84238CF985AF0
                                                                                                                                                                                                                                            SHA1:35C7AA128D47710CFDB15BB6809A20DBD0F916D8
                                                                                                                                                                                                                                            SHA-256:253D18D0D835F482E6ABBAF716855580EB8FE789292C937301E4D60EAD29531D
                                                                                                                                                                                                                                            SHA-512:0CBF35C9D7B09FB57D8A9079EAB726A3891393F12AEE8B43E01D1D979509E755B74C0FB677F8F2DFAB6B2E34A141F65D0CFBFE57BDA0BF7482841AD31ACE7790
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".... Z..........`........................................ .......U..........................................................P............p.. ........g......0...................................................@................................text... Z.......\.................. ..`.data........p.......`..............@....rdata...............z..............@..@.pdata.. ....p...0...T..............@..@.bss.....................................CRT................................@....idata..............................@....edata..............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\main.lua (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):201
                                                                                                                                                                                                                                            Entropy (8bit):4.465403493165412
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:JW4+sNv/lQBAHpbs/UcUFJKPACcAE8J6Xv:JB+slzs/tUrKcbXv
                                                                                                                                                                                                                                            MD5:62771A63FDC87764BFF87D82918AB02A
                                                                                                                                                                                                                                            SHA1:8E468DED8CED87A10470BD5594337A854FF344BA
                                                                                                                                                                                                                                            SHA-256:5C16124BA0B39214BECB1AF4161BD82147AD8468879A3FD8E9FACC656A1D2E6F
                                                                                                                                                                                                                                            SHA-512:8D1792B712504336CAC0B175146F2B7EAEDA043BD3941C7B7C54CF926A4BA4835F0EFF7A2AD5C7B5509F80E7420C3F5F94200D4C3F922DB92B807E20E09A84D0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:--This lua script gets loaded when Cheat Engine loads..--You can use this to define some often used functions and libraries you'd like to use....require("defines")....--for documentation read celua.txt

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\overlay.fx (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2086
                                                                                                                                                                                                                                            Entropy (8bit):4.748005607182281
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:HZooJUJAimKakohOgM4TDB6liofD0x6g8W:HioemKakaOgM4J6l5C6g8W
                                                                                                                                                                                                                                            MD5:650C02FC9F949D14D62E32DD7A894F5E
                                                                                                                                                                                                                                            SHA1:FA5399B01AADD9F1A4A5632F8632711C186EC0DE
                                                                                                                                                                                                                                            SHA-256:C4D23DB8EFFB359B4AA4D1E1E480486FE3A4586CE8243397A94250627BA4F8CC
                                                                                                                                                                                                                                            SHA-512:F2CAAF604C271283FC7AF3AA9674B9D647C4AC53DFFCA031DBF1220D3ED2E867943F5409A95F41C61D716879BED7C888735F43A068F1CC1452B4196D611CB76D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview://credits: ms d3d tutorials which I hacked apart....Texture2D txDiffuse : register( t0 );..SamplerState samLinear : register( s0 );....cbuffer ConstantBuffer : register( b0 )..{....float4x4 rotation;.. float2 originpoint;...float2 translation;...float2 scaling;...float transparency;....float garbage;...}..........//--------------------------------------------------------------------------------------..struct VS_INPUT..{.. float4 Pos : POSITION;.. float2 Tex : TEXCOORD0;..};....struct PS_INPUT..{.. float4 Pos : SV_POSITION;.. float2 Tex : TEXCOORD0;..};......//--------------------------------------------------------------------------------------..// Vertex Shader..//--------------------------------------------------------------------------------------..PS_INPUT VS( VS_INPUT input )..{.... PS_INPUT r=input;.. float4 rp;........ r.Pos[0]-=originpoint[0];.. r.Pos[1]+=originpoint[1];.. r.Pos=mul(r.Pos, rotation);.... r.Pos[0]+=originpoint[0];.. r.Pos[

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary.sln (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1513
                                                                                                                                                                                                                                            Entropy (8bit):5.570853751982549
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:pPEkvanEc5GgSyTA8VffAa6iAoPARiA2PAo6kA68IAvkAU8TlzbBW:pP0EmdSy8ZLlHRl19DPXvDxts
                                                                                                                                                                                                                                            MD5:8E1EECB2D6B4F579A7FE4B11361E1D96
                                                                                                                                                                                                                                            SHA1:647911F537437A80F06C1324AC9AF5843BFCFA01
                                                                                                                                                                                                                                            SHA-256:37DAA1B4FB9966A0EED6DAEBB98FAE863C92F433D97CEA90DD95107FA7F14A1A
                                                                                                                                                                                                                                            SHA-512:1BE14802B7B2C13DCAEDBFB8814C7DF011A48C27D83C249EE5C074ACD0AF2070595D8809EC1EF92A6DE1FF4BFA55B3D393A9E5390C04EEF72FD1F1952DA2CCAE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 15..VisualStudioVersion = 15.0.28307.489..MinimumVisualStudioVersion = 10.0.40219.1..Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CEPluginLibrary", "CEPluginLibrary\CEPluginLibrary.csproj", "{99772D98-3865-4E8D-BB02-A855950904F8}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Any CPU = Debug|Any CPU....Debug|x64 = Debug|x64....Release|Any CPU = Release|Any CPU....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|Any CPU.ActiveCfg = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|Any CPU.Build.0 = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|x64.ActiveCfg = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|x64.Build.0 = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Release|Any CPU.ActiveCfg = Releas

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\CEPluginLibrary.csproj (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2926
                                                                                                                                                                                                                                            Entropy (8bit):5.296204236636278
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:3rYSjNJpu5z2fBZi43iqcscr14H1xmH/14H1BA6B6Kv6tH6T626HZ6sM6l6a6A3E:7YWnpu5CZi4ncsZxm4GE5vsHSBCHMOVo
                                                                                                                                                                                                                                            MD5:BD4AB4CC0D5BED5FBC5228F4035A191D
                                                                                                                                                                                                                                            SHA1:AE2B589B7342B9C2D30BDBE3575509F6C3DB5D47
                                                                                                                                                                                                                                            SHA-256:65121FFC91A1EEF66A3281ACFF99C3014DB81FF143A47B02ED6953710CFCAFD5
                                                                                                                                                                                                                                            SHA-512:81C9CCC18BB5BD0A0F714CB625E1EF0FB62EE20106A3386D812E343D322B7BCE435D5C61D575AE68DA26504B39131D5FBCF405524ADD8233A0D0E4E4405811AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />.. <PropertyGroup>.. <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>.. <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>.. <ProjectGuid>{99772D98-3865-4E8D-BB02-A855950904F8}</ProjectGuid>.. <OutputType>Library</OutputType>.. <AppDesignerFolder>Properties</AppDesignerFolder>.. <RootNamespace>CEPluginLibrary</RootNamespace>.. <AssemblyName>CEPluginExample</AssemblyName>.. <TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>.. <FileAlignment>512</FileAlignment>.. <Deterministic>true</Deterministic>.. </PropertyGroup>.. <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExample.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4778
                                                                                                                                                                                                                                            Entropy (8bit):4.4952095990499785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h2nXV0VgqojlWXS+vx+FvDVfv6nEbvFUG7Fnm4Auzsq8tdlvuO4BVNT:9UF4ajlWXS+vx+FvDVfv6WdUGBnm4Au9
                                                                                                                                                                                                                                            MD5:B45C3E2829EED1BEB58ED85D8E27362B
                                                                                                                                                                                                                                            SHA1:9AFF1824269B8829B4903AC0DC53E7B314CAD5D0
                                                                                                                                                                                                                                            SHA-256:B16C0C45DCD137B01C6BB2ED3BBB7DECB406FDEC3D4AEBBF1F6EEB44E9039397
                                                                                                                                                                                                                                            SHA-512:771506912072FE9EB3500C9CCC9D02236B1DB579E02ECE9ABE538548B5F2FC0AD312EDF576DFCDE97F64E573D7B70B6CD73452BA426AAB1E8F31A9431942CC89
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. class PluginExample : CESDKPluginClass.. {.. public override string GetPluginName().. {.. return "C# Plugin Template for Cheat Engine 7.1+";.. }.... public override bool DisablePlugin() //called when disabled.. {.. .. return true;.. }.. .. public override bool EnablePlugin() //called when enabled.. {.. //you can use sdk here.. //sdk.lua.dostring("print('I am alive')");.. .... sdk.lua.Register("pluginexample1", MyFunction);.. sdk.lua.Register("pluginexample2", MyFunction2);.. sdk.lua.Register("pluginexample3", MyFunction3);.. sdk.lua.Register("pluginexample4", MyFunction4);.. sdk

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExampleForm.Designer.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9887
                                                                                                                                                                                                                                            Entropy (8bit):4.5923744109984925
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Jwa+UHCXRQbXVkmGqYnowGCo0Q3fHRlsc5guLWoeU80bklzg8:Jw1UHqRQbXAoLCtQPHbsc5guLWD0bmh
                                                                                                                                                                                                                                            MD5:48A54615FB62B5964D621D88ABFF8C98
                                                                                                                                                                                                                                            SHA1:8131BA02B49DF23D592EF8FD24B1C9BED5BA0B94
                                                                                                                                                                                                                                            SHA-256:8E4B2FFFDA394E6F9376A930C3B0F1BAEFAF69CE68FA17C0A80A5B49D22633D0
                                                                                                                                                                                                                                            SHA-512:A433DD6D692263B3C190F1B1113962BEDCF68C0C947B1CD4C7BFD32755A397B9DBA02E3E668F7B548CB21C869E8D2183FDDCC2519D9D15082AA2C664CB0DF902
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.namespace CEPluginLibrary..{.. partial class PluginExampleForm.. {.. /// <summary>.. /// Required designer variable... /// </summary>.. private System.ComponentModel.IContainer components = null;.... /// <summary>.. /// Clean up any resources being used... /// </summary>.. /// <param name="disposing">true if managed resources should be disposed; otherwise, false.</param>.. protected override void Dispose(bool disposing).. {.. if (disposing && (components != null)).. {.. components.Dispose();.. }.. base.Dispose(disposing);.. }.... #region Windows Form Designer generated code.... /// <summary>.. /// Required method for Designer support - do not modify.. /// the contents of this method with the code editor... /// </summary>.. private void InitializeComponent().. {.. this.button1 = new Sy

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExampleForm.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5253
                                                                                                                                                                                                                                            Entropy (8bit):4.220186376885213
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h4Dcz02nXVgqQUmzIxT1Y7wx7F74GwPgVK5z536uChJYqt+9UYNY:9KGpFDy7C7FwPgVcqu1NY
                                                                                                                                                                                                                                            MD5:D6A1CE4FE7D7E9321C47B5BA48BB0675
                                                                                                                                                                                                                                            SHA1:D2F7178B9607765FDBFC869EF2F3F25405E9D2E4
                                                                                                                                                                                                                                            SHA-256:F47E49AB8E84189B6C1DD2B4A018C43992B34B5E2C025B09CCE8BE9D60C58B6B
                                                                                                                                                                                                                                            SHA-512:9F4428E86FDF025D94BA897CC68B91056FF28A4BD2ED12DE2B9FEDE00D4396F3F53D05E4115D8CFD8F50B83891A7994001ED359E3A01C53C8578CD89DE5CC338
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.ComponentModel;..using System.Data;..using System.Drawing;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. public partial class PluginExampleForm : Form.. {.. MemScan ms;.. FoundList fl;.... public PluginExampleForm().. {.. InitializeComponent();.. }.... private void button1_Click(object sender, EventArgs e).. { .. MessageBox.Show("WEEEEEEE");.. GC.Collect();.. }.... .... private void MemScanDone(object sender).. {.. //called from CE's main UI thread. Problematic if the form was created using a new thread.. if (this.InvokeRequired).. { .. this.BeginInvoke(((MemScan)sender).OnScanDone,sender);.. }.. else..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExampleForm.resx (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5817
                                                                                                                                                                                                                                            Entropy (8bit):4.7214047966009245
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
                                                                                                                                                                                                                                            MD5:4EB5913A0E5AA842250F7419538FA230
                                                                                                                                                                                                                                            SHA1:31FB76E5D9BABE97A11FEA041081F96CE426107A
                                                                                                                                                                                                                                            SHA-256:4363CD7D5B8671C72442CE1A1BFC10D64EBD24B2D718B54BD4FCD025E4967298
                                                                                                                                                                                                                                            SHA-512:846207F9DB4C05D2070482C27AF72C50B8F423AC1C7EFB5266B059F6A41362704E9F5A590E428F4AEFD791EDD2E21C1B34473361911CBEEA2CFCAF741B5BEBFF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<root>.. .. Microsoft ResX Schema .. .. Version 2.0.. .. The primary goals of this format is to allow a simple XML format .. that is mostly human readable. The generation and parsing of the .. various data types are done through the TypeConverter classes .. associated with the data types... .. Example:.. .. ... ado.net/XML headers & schema ..... <resheader name="resmimetype">text/microsoft-resx</resheader>.. <resheader name="version">2.0</resheader>.. <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>.. <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>.. <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>.. <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>.. <data name="Bitmap1" mimetype="application/x-microsoft

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\AssemblyInfo.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1437
                                                                                                                                                                                                                                            Entropy (8bit):5.076090513105922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:JINebtJwLK0YRr/h+K+BPG/+W+t7kn5e3rmXeYhQ7MJnYUc:Jwebt+LKJRr/hp+PG/j+hk5eCuYh/5YF
                                                                                                                                                                                                                                            MD5:62142985D98CA0708215AACD89AEB34D
                                                                                                                                                                                                                                            SHA1:98382B9A288905D9A38B013122A22A6118990FD7
                                                                                                                                                                                                                                            SHA-256:B308630E16DAAE770982D45A64A9AC63136921A1F174CBC0A645E36142DB2128
                                                                                                                                                                                                                                            SHA-512:BAEC8A5EDBD21140A8424721D7E16F16FDDB61D9E4EC026A5C10C22B52FA389F98A1756928FA0967959CB4B1EBC22ACF48A11F5C308E256BCF74037F637E817E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System.Reflection;..using System.Runtime.CompilerServices;..using System.Runtime.InteropServices;....// General Information about an assembly is controlled through the following..// set of attributes. Change these attribute values to modify the information..// associated with an assembly...[assembly: AssemblyTitle("CEPluginLibrary")]..[assembly: AssemblyDescription("")]..[assembly: AssemblyConfiguration("")]..[assembly: AssemblyCompany("")]..[assembly: AssemblyProduct("CEPluginLibrary")]..[assembly: AssemblyCopyright("Copyright . 2020")]..[assembly: AssemblyTrademark("")]..[assembly: AssemblyCulture("")]....// Setting ComVisible to false makes the types in this assembly not visible..// to COM components. If you need to access a type in this assembly from..// COM, set the ComVisible attribute to true on that type...[assembly: ComVisible(false)]....// The following GUID is for the ID of the typelib if this project is exposed to COM..[assembly: Guid("99772d98-3865-4e8d-bb02-a8

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\is-0JRFM.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1437
                                                                                                                                                                                                                                            Entropy (8bit):5.076090513105922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:JINebtJwLK0YRr/h+K+BPG/+W+t7kn5e3rmXeYhQ7MJnYUc:Jwebt+LKJRr/hp+PG/j+hk5eCuYh/5YF
                                                                                                                                                                                                                                            MD5:62142985D98CA0708215AACD89AEB34D
                                                                                                                                                                                                                                            SHA1:98382B9A288905D9A38B013122A22A6118990FD7
                                                                                                                                                                                                                                            SHA-256:B308630E16DAAE770982D45A64A9AC63136921A1F174CBC0A645E36142DB2128
                                                                                                                                                                                                                                            SHA-512:BAEC8A5EDBD21140A8424721D7E16F16FDDB61D9E4EC026A5C10C22B52FA389F98A1756928FA0967959CB4B1EBC22ACF48A11F5C308E256BCF74037F637E817E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System.Reflection;..using System.Runtime.CompilerServices;..using System.Runtime.InteropServices;....// General Information about an assembly is controlled through the following..// set of attributes. Change these attribute values to modify the information..// associated with an assembly...[assembly: AssemblyTitle("CEPluginLibrary")]..[assembly: AssemblyDescription("")]..[assembly: AssemblyConfiguration("")]..[assembly: AssemblyCompany("")]..[assembly: AssemblyProduct("CEPluginLibrary")]..[assembly: AssemblyCopyright("Copyright . 2020")]..[assembly: AssemblyTrademark("")]..[assembly: AssemblyCulture("")]....// Setting ComVisible to false makes the types in this assembly not visible..// to COM components. If you need to access a type in this assembly from..// COM, set the ComVisible attribute to true on that type...[assembly: ComVisible(false)]....// The following GUID is for the ID of the typelib if this project is exposed to COM..[assembly: Guid("99772d98-3865-4e8d-bb02-a8

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\CEObjectWrapper.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):982
                                                                                                                                                                                                                                            Entropy (8bit):4.435515760549183
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:Jo4KM2nkqVp3gqI6BkUSx2n1TY6yhdRcAv1iY:Jo4h2nXVGqI6GU5dyFxiY
                                                                                                                                                                                                                                            MD5:5D0DEB0B6B7C873B5F56BCEDA264B77F
                                                                                                                                                                                                                                            SHA1:49EE6163658B643F4368471239A0E0D196DD714D
                                                                                                                                                                                                                                            SHA-256:AD5E1FC96B40B64A65C5901006BD4823FF71B5D846856DB89115D667D112ED6A
                                                                                                                                                                                                                                            SHA-512:F5322FE291655663EB3D2817AD17C3CFF4ABF6A9D2F9B85B93060DB782BA63E82B7A1B5969849B9CEF25552F5F0E35EFE1572C0A48AB4869F54B304524C1565A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. /// <summary>.. /// Base class for implementing objects inherited from TObject (just a destructor in this case).. /// </summary>.. class CEObjectWrapper.. { .. protected CESDKLua lua = CESDK.currentPlugin.sdk.lua;.. protected IntPtr CEObject;.. public IntPtr obj { get { return CEObject; } }........ ~CEObjectWrapper().. {.. if (CEObject != IntPtr.Zero).. {.. lua.PushCEObject(CEObject);.. lua.PushString("destroy");.. lua.GetTable(-2);.... if (lua.IsFunction(-1)).. {.. lua.PCall(0, 0);.. }.. else.. throw new System.ApplicationException("Object without a destroy method");.. }.. }.. }..}..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\CESDK.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6763
                                                                                                                                                                                                                                            Entropy (8bit):4.595472479915153
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:9UbHGZa1JsDzbH6eHpRHQHOHLOGNQfzN8fWsZEPjR2uTDKIuj1JK+Kz:9ksD7wurO9zjsu1rTuS
                                                                                                                                                                                                                                            MD5:AB17C7A5C7A57BA82912E2D05D1CE525
                                                                                                                                                                                                                                            SHA1:A32917633EB47144520E2DCA14E15F5F46643A4E
                                                                                                                                                                                                                                            SHA-256:545F6394AAE6C7DE8DF94DB797BBE09EB87AAAED2A5A22410BD42618F7F61999
                                                                                                                                                                                                                                            SHA-512:8B0F2C787BB79F6A40628AF3AB9D16A08A15128EE4D79E4F9DFBEA663200C00C5391C6CF965DE502F79E5927283FC42E700B9AA3664A78DB4404046AB9D81251
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Runtime.InteropServices;..using System.Text;..using System.Threading.Tasks;..using System.Reflection;......//CE SDK wrapper. You usually don't need to be here, so close your eyes and walk away....namespace CESDK..{.. .. public abstract class CESDKPluginClass.. {.. public CESDK sdk;.. public abstract String GetPluginName();.. public abstract Boolean EnablePlugin();.. public abstract Boolean DisablePlugin();.. }.... [StructLayout(LayoutKind.Sequential)].. public struct TExportedFunctions.. {.. public int sizeofExportedFunctions;.. public IntPtr GetLuaState;.. public IntPtr LuaRegister;.. public IntPtr LuaPushClassInstance;.. public IntPtr ProcessMessages;.. public IntPtr CheckSynchronize;.. }.... public class CESDK.. {.. public static CESDKPluginClass currentPlugin;.. public CESDKLua lua;..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\CESDKLua.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):23899
                                                                                                                                                                                                                                            Entropy (8bit):4.746150555809051
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:48k5CqoQyEIC9hgEcxmae6QtCJBn/wbvQN3cPcsq4FxNUjrbqXEozS/q/hQXb6mV:WUq5QXey
                                                                                                                                                                                                                                            MD5:2B831125B3F0573EC8B12FDB91DA2FD3
                                                                                                                                                                                                                                            SHA1:E6AEDE01D2EA3D05D825A8D04D0DD9E3831EEA84
                                                                                                                                                                                                                                            SHA-256:7E625FFA7E5F39351AA558021886075A251A24C111AE3C67AB75A2487EEF6689
                                                                                                                                                                                                                                            SHA-512:E811D11FB8C2F24AE9A6893989702E9ECF674C977704D29733FCA44491FF793CB3E8A4DD99D699145AAE92EFAB0F64CC63615EA3108953024516CB95EB927D35
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.//Copyright Cheat Engine 2020..using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Runtime.InteropServices;....namespace CESDK..{.. public class CESDKLua.. {.. private const int LUA_TNONE = -1;.. private const int LUA_TNIL = 0;.. private const int LUA_TBOOLEAN = 1;.. private const int LUA_TLIGHTUSERDATA = 2;.. private const int LUA_TNUMBER = 3;.. private const int LUA_TSTRING = 4;.. private const int LUA_TTABLE = 5;.. private const int LUA_TFUNCTION = 6;.. private const int LUA_TUSERDATA = 7;.. private const int LUA_TTHREAD = 8; .... [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Ansi)].. static extern IntPtr LoadLibraryA([MarshalAs(UnmanagedType.LPStr)]string lpFileName);.... [DllImport("kernel32.dll", SetLastError = true, Cha

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\FoundList.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3404
                                                                                                                                                                                                                                            Entropy (8bit):3.9340216921200066
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h2nXVG6n6cbwhwGICIIAIwhICIIA9jx5J:9UFL6PIfIz
                                                                                                                                                                                                                                            MD5:1DD2F4D1FACD43BB2CA69C75FEA92A5B
                                                                                                                                                                                                                                            SHA1:E9B62F784A2BB86A26A31D6F82679DFC483FFB58
                                                                                                                                                                                                                                            SHA-256:6B412B63F5B15B7B247A191D4D76F4B9F4F3F135DA44E46A31CE1C801DDBDA4C
                                                                                                                                                                                                                                            SHA-512:A09A38C925F5CB3043CCFF4C4A07715DFEA6666B116DA6120F21FF53C2A201A841C936639E3A9A58ABE4E320FE12155936E9890F5DB7CBD1128D93110AECB26B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like...... class FoundList :CEObjectWrapper.. {.. public int Count { get { return GetCount(); } }.... int GetCount().. {.. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Count");.. lua.GetTable(-2);.... return (int)lua.ToInteger(-1);.. }.. finally.. {.. lua.SetTop(0);.. } .. }.... public string GetAddress(int i).. {.. .. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Address");.. lua.GetTable(-2

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\MemScan.cs (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8480
                                                                                                                                                                                                                                            Entropy (8bit):4.327578339834133
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h2nXVG6ncxU750WM5Eo7F1MF1F8S+sY7wxhJ0wxLnwgcLiBsl6qRRt0txt5qX:9UFLcxU90WCnx7eLOLkiL1L327mDl
                                                                                                                                                                                                                                            MD5:8570870BDF281AA6FE801B53CB4647DE
                                                                                                                                                                                                                                            SHA1:0A6F0EAE1BAD8AE9BA42CA49CE963C1EC6758522
                                                                                                                                                                                                                                            SHA-256:2B3F24397889FEF6B449D252A8929C57C6765C73D93A717902F6F5E63DFBDDC2
                                                                                                                                                                                                                                            SHA-512:86E436029AF6968289B54204A8F008ABD50ACECC889C1A6773BF2C3073196F366203A2D506BEC85AF3CC580CD71C3806708AD745DD65D18A2AE0D02AA4F5F1E1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like.... public enum ScanOptions.. {.. soUnknownValue = 0,.. soExactValue = 1,.. soValueBetween = 2,.. soBiggerThan = 3,.. soSmallerThan = 4,.. soIncreasedValue = 5,.. soIncreasedValueBy = 6,.. soDecreasedValue = 7,.. soDecreasedValueBy = 8,.. soChanged = 9,.. soUnchanged = 10.. }.... public enum VarTypes.. {.. vtByte = 0,.. vtWord = 1,.. vtDword = 2,.. vtQword = 3,.. vtSingle = 4,.. vtDouble = 5,.. vtString = 6,.. vtUnicodeString = 7, //--Only used by autoguess.. vtWideString = 7,.. vtByteArray = 8,.. vtBinary = 9,..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-1DJ85.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):982
                                                                                                                                                                                                                                            Entropy (8bit):4.435515760549183
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:Jo4KM2nkqVp3gqI6BkUSx2n1TY6yhdRcAv1iY:Jo4h2nXVGqI6GU5dyFxiY
                                                                                                                                                                                                                                            MD5:5D0DEB0B6B7C873B5F56BCEDA264B77F
                                                                                                                                                                                                                                            SHA1:49EE6163658B643F4368471239A0E0D196DD714D
                                                                                                                                                                                                                                            SHA-256:AD5E1FC96B40B64A65C5901006BD4823FF71B5D846856DB89115D667D112ED6A
                                                                                                                                                                                                                                            SHA-512:F5322FE291655663EB3D2817AD17C3CFF4ABF6A9D2F9B85B93060DB782BA63E82B7A1B5969849B9CEF25552F5F0E35EFE1572C0A48AB4869F54B304524C1565A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. /// <summary>.. /// Base class for implementing objects inherited from TObject (just a destructor in this case).. /// </summary>.. class CEObjectWrapper.. { .. protected CESDKLua lua = CESDK.currentPlugin.sdk.lua;.. protected IntPtr CEObject;.. public IntPtr obj { get { return CEObject; } }........ ~CEObjectWrapper().. {.. if (CEObject != IntPtr.Zero).. {.. lua.PushCEObject(CEObject);.. lua.PushString("destroy");.. lua.GetTable(-2);.... if (lua.IsFunction(-1)).. {.. lua.PCall(0, 0);.. }.. else.. throw new System.ApplicationException("Object without a destroy method");.. }.. }.. }..}..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-3AB8G.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3404
                                                                                                                                                                                                                                            Entropy (8bit):3.9340216921200066
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h2nXVG6n6cbwhwGICIIAIwhICIIA9jx5J:9UFL6PIfIz
                                                                                                                                                                                                                                            MD5:1DD2F4D1FACD43BB2CA69C75FEA92A5B
                                                                                                                                                                                                                                            SHA1:E9B62F784A2BB86A26A31D6F82679DFC483FFB58
                                                                                                                                                                                                                                            SHA-256:6B412B63F5B15B7B247A191D4D76F4B9F4F3F135DA44E46A31CE1C801DDBDA4C
                                                                                                                                                                                                                                            SHA-512:A09A38C925F5CB3043CCFF4C4A07715DFEA6666B116DA6120F21FF53C2A201A841C936639E3A9A58ABE4E320FE12155936E9890F5DB7CBD1128D93110AECB26B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like...... class FoundList :CEObjectWrapper.. {.. public int Count { get { return GetCount(); } }.... int GetCount().. {.. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Count");.. lua.GetTable(-2);.... return (int)lua.ToInteger(-1);.. }.. finally.. {.. lua.SetTop(0);.. } .. }.... public string GetAddress(int i).. {.. .. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Address");.. lua.GetTable(-2

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-CFR84.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8480
                                                                                                                                                                                                                                            Entropy (8bit):4.327578339834133
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h2nXVG6ncxU750WM5Eo7F1MF1F8S+sY7wxhJ0wxLnwgcLiBsl6qRRt0txt5qX:9UFLcxU90WCnx7eLOLkiL1L327mDl
                                                                                                                                                                                                                                            MD5:8570870BDF281AA6FE801B53CB4647DE
                                                                                                                                                                                                                                            SHA1:0A6F0EAE1BAD8AE9BA42CA49CE963C1EC6758522
                                                                                                                                                                                                                                            SHA-256:2B3F24397889FEF6B449D252A8929C57C6765C73D93A717902F6F5E63DFBDDC2
                                                                                                                                                                                                                                            SHA-512:86E436029AF6968289B54204A8F008ABD50ACECC889C1A6773BF2C3073196F366203A2D506BEC85AF3CC580CD71C3806708AD745DD65D18A2AE0D02AA4F5F1E1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like.... public enum ScanOptions.. {.. soUnknownValue = 0,.. soExactValue = 1,.. soValueBetween = 2,.. soBiggerThan = 3,.. soSmallerThan = 4,.. soIncreasedValue = 5,.. soIncreasedValueBy = 6,.. soDecreasedValue = 7,.. soDecreasedValueBy = 8,.. soChanged = 9,.. soUnchanged = 10.. }.... public enum VarTypes.. {.. vtByte = 0,.. vtWord = 1,.. vtDword = 2,.. vtQword = 3,.. vtSingle = 4,.. vtDouble = 5,.. vtString = 6,.. vtUnicodeString = 7, //--Only used by autoguess.. vtWideString = 7,.. vtByteArray = 8,.. vtBinary = 9,..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-CRBIK.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):23899
                                                                                                                                                                                                                                            Entropy (8bit):4.746150555809051
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:48k5CqoQyEIC9hgEcxmae6QtCJBn/wbvQN3cPcsq4FxNUjrbqXEozS/q/hQXb6mV:WUq5QXey
                                                                                                                                                                                                                                            MD5:2B831125B3F0573EC8B12FDB91DA2FD3
                                                                                                                                                                                                                                            SHA1:E6AEDE01D2EA3D05D825A8D04D0DD9E3831EEA84
                                                                                                                                                                                                                                            SHA-256:7E625FFA7E5F39351AA558021886075A251A24C111AE3C67AB75A2487EEF6689
                                                                                                                                                                                                                                            SHA-512:E811D11FB8C2F24AE9A6893989702E9ECF674C977704D29733FCA44491FF793CB3E8A4DD99D699145AAE92EFAB0F64CC63615EA3108953024516CB95EB927D35
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.//Copyright Cheat Engine 2020..using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Runtime.InteropServices;....namespace CESDK..{.. public class CESDKLua.. {.. private const int LUA_TNONE = -1;.. private const int LUA_TNIL = 0;.. private const int LUA_TBOOLEAN = 1;.. private const int LUA_TLIGHTUSERDATA = 2;.. private const int LUA_TNUMBER = 3;.. private const int LUA_TSTRING = 4;.. private const int LUA_TTABLE = 5;.. private const int LUA_TFUNCTION = 6;.. private const int LUA_TUSERDATA = 7;.. private const int LUA_TTHREAD = 8; .... [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Ansi)].. static extern IntPtr LoadLibraryA([MarshalAs(UnmanagedType.LPStr)]string lpFileName);.... [DllImport("kernel32.dll", SetLastError = true, Cha

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-DV6EG.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6763
                                                                                                                                                                                                                                            Entropy (8bit):4.595472479915153
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:9UbHGZa1JsDzbH6eHpRHQHOHLOGNQfzN8fWsZEPjR2uTDKIuj1JK+Kz:9ksD7wurO9zjsu1rTuS
                                                                                                                                                                                                                                            MD5:AB17C7A5C7A57BA82912E2D05D1CE525
                                                                                                                                                                                                                                            SHA1:A32917633EB47144520E2DCA14E15F5F46643A4E
                                                                                                                                                                                                                                            SHA-256:545F6394AAE6C7DE8DF94DB797BBE09EB87AAAED2A5A22410BD42618F7F61999
                                                                                                                                                                                                                                            SHA-512:8B0F2C787BB79F6A40628AF3AB9D16A08A15128EE4D79E4F9DFBEA663200C00C5391C6CF965DE502F79E5927283FC42E700B9AA3664A78DB4404046AB9D81251
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Runtime.InteropServices;..using System.Text;..using System.Threading.Tasks;..using System.Reflection;......//CE SDK wrapper. You usually don't need to be here, so close your eyes and walk away....namespace CESDK..{.. .. public abstract class CESDKPluginClass.. {.. public CESDK sdk;.. public abstract String GetPluginName();.. public abstract Boolean EnablePlugin();.. public abstract Boolean DisablePlugin();.. }.... [StructLayout(LayoutKind.Sequential)].. public struct TExportedFunctions.. {.. public int sizeofExportedFunctions;.. public IntPtr GetLuaState;.. public IntPtr LuaRegister;.. public IntPtr LuaPushClassInstance;.. public IntPtr ProcessMessages;.. public IntPtr CheckSynchronize;.. }.... public class CESDK.. {.. public static CESDKPluginClass currentPlugin;.. public CESDKLua lua;..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\CEPluginExample.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):37888
                                                                                                                                                                                                                                            Entropy (8bit):5.226890017930093
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:o59YiDgzS3ejrtGtl1Ym+l+rZz4Awdewwwwd2d+e5R777N1HVM7gbvIVBlGiezFM:PmgeujrtGt7Ym+AZxwdewwwwcd+e5RPa
                                                                                                                                                                                                                                            MD5:2DF506F3E3969F3DDA3EF32D21F8B210
                                                                                                                                                                                                                                            SHA1:77391130A4C3853315882FEA9877B5A0132E737F
                                                                                                                                                                                                                                            SHA-256:C49E654839B293C1D1E6D5F245E49A8CAD787E70B3D0EB2659024E6D6ED44BC5
                                                                                                                                                                                                                                            SHA-512:22F7F01EBE710423548015C3C87F758F07AEEC93FEFECE5ED6C2AAE8C3D6BAF26D60678E382A0C97B7C8942F2163140146C002D72ABF3014708A4147B654F410
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0.................. ........... ....................................`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D..|d..........8.................................................(....*2.{....o....*6.{.....o....*R.~....}......}.....*.0..y.........}......q....}.....{....-...|....{....(...+}.....{....-...|....{....(...+}.....{....-...so...}....~.....}....~....o....*.~....o....*..(............s....}............s....}............s....}....*..0..........~....-.s.........~....(....-k.....(....o....o.......+,........(....o....,....(....t.........+...X...(...+2.~....-..*~....o....(.....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-LPLPI.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):37888
                                                                                                                                                                                                                                            Entropy (8bit):5.226890017930093
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:o59YiDgzS3ejrtGtl1Ym+l+rZz4Awdewwwwd2d+e5R777N1HVM7gbvIVBlGiezFM:PmgeujrtGt7Ym+AZxwdewwwwcd+e5RPa
                                                                                                                                                                                                                                            MD5:2DF506F3E3969F3DDA3EF32D21F8B210
                                                                                                                                                                                                                                            SHA1:77391130A4C3853315882FEA9877B5A0132E737F
                                                                                                                                                                                                                                            SHA-256:C49E654839B293C1D1E6D5F245E49A8CAD787E70B3D0EB2659024E6D6ED44BC5
                                                                                                                                                                                                                                            SHA-512:22F7F01EBE710423548015C3C87F758F07AEEC93FEFECE5ED6C2AAE8C3D6BAF26D60678E382A0C97B7C8942F2163140146C002D72ABF3014708A4147B654F410
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0.................. ........... ....................................`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D..|d..........8.................................................(....*2.{....o....*6.{.....o....*R.~....}......}.....*.0..y.........}......q....}.....{....-...|....{....(...+}.....{....-...|....{....(...+}.....{....-...so...}....~.....}....~....o....*.~....o....*..(............s....}............s....}............s....}....*..0..........~....-.s.........~....(....-k.....(....o....o.......+,........(....o....,....(....t.........+...X...(...+2.~....-..*~....o....(.....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-2CS23.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9887
                                                                                                                                                                                                                                            Entropy (8bit):4.5923744109984925
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Jwa+UHCXRQbXVkmGqYnowGCo0Q3fHRlsc5guLWoeU80bklzg8:Jw1UHqRQbXAoLCtQPHbsc5guLWD0bmh
                                                                                                                                                                                                                                            MD5:48A54615FB62B5964D621D88ABFF8C98
                                                                                                                                                                                                                                            SHA1:8131BA02B49DF23D592EF8FD24B1C9BED5BA0B94
                                                                                                                                                                                                                                            SHA-256:8E4B2FFFDA394E6F9376A930C3B0F1BAEFAF69CE68FA17C0A80A5B49D22633D0
                                                                                                                                                                                                                                            SHA-512:A433DD6D692263B3C190F1B1113962BEDCF68C0C947B1CD4C7BFD32755A397B9DBA02E3E668F7B548CB21C869E8D2183FDDCC2519D9D15082AA2C664CB0DF902
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.namespace CEPluginLibrary..{.. partial class PluginExampleForm.. {.. /// <summary>.. /// Required designer variable... /// </summary>.. private System.ComponentModel.IContainer components = null;.... /// <summary>.. /// Clean up any resources being used... /// </summary>.. /// <param name="disposing">true if managed resources should be disposed; otherwise, false.</param>.. protected override void Dispose(bool disposing).. {.. if (disposing && (components != null)).. {.. components.Dispose();.. }.. base.Dispose(disposing);.. }.... #region Windows Form Designer generated code.... /// <summary>.. /// Required method for Designer support - do not modify.. /// the contents of this method with the code editor... /// </summary>.. private void InitializeComponent().. {.. this.button1 = new Sy

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-3PV83.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5817
                                                                                                                                                                                                                                            Entropy (8bit):4.7214047966009245
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
                                                                                                                                                                                                                                            MD5:4EB5913A0E5AA842250F7419538FA230
                                                                                                                                                                                                                                            SHA1:31FB76E5D9BABE97A11FEA041081F96CE426107A
                                                                                                                                                                                                                                            SHA-256:4363CD7D5B8671C72442CE1A1BFC10D64EBD24B2D718B54BD4FCD025E4967298
                                                                                                                                                                                                                                            SHA-512:846207F9DB4C05D2070482C27AF72C50B8F423AC1C7EFB5266B059F6A41362704E9F5A590E428F4AEFD791EDD2E21C1B34473361911CBEEA2CFCAF741B5BEBFF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<root>.. .. Microsoft ResX Schema .. .. Version 2.0.. .. The primary goals of this format is to allow a simple XML format .. that is mostly human readable. The generation and parsing of the .. various data types are done through the TypeConverter classes .. associated with the data types... .. Example:.. .. ... ado.net/XML headers & schema ..... <resheader name="resmimetype">text/microsoft-resx</resheader>.. <resheader name="version">2.0</resheader>.. <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>.. <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>.. <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>.. <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>.. <data name="Bitmap1" mimetype="application/x-microsoft

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-DQ90M.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2926
                                                                                                                                                                                                                                            Entropy (8bit):5.296204236636278
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:3rYSjNJpu5z2fBZi43iqcscr14H1xmH/14H1BA6B6Kv6tH6T626HZ6sM6l6a6A3E:7YWnpu5CZi4ncsZxm4GE5vsHSBCHMOVo
                                                                                                                                                                                                                                            MD5:BD4AB4CC0D5BED5FBC5228F4035A191D
                                                                                                                                                                                                                                            SHA1:AE2B589B7342B9C2D30BDBE3575509F6C3DB5D47
                                                                                                                                                                                                                                            SHA-256:65121FFC91A1EEF66A3281ACFF99C3014DB81FF143A47B02ED6953710CFCAFD5
                                                                                                                                                                                                                                            SHA-512:81C9CCC18BB5BD0A0F714CB625E1EF0FB62EE20106A3386D812E343D322B7BCE435D5C61D575AE68DA26504B39131D5FBCF405524ADD8233A0D0E4E4405811AF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />.. <PropertyGroup>.. <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>.. <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>.. <ProjectGuid>{99772D98-3865-4E8D-BB02-A855950904F8}</ProjectGuid>.. <OutputType>Library</OutputType>.. <AppDesignerFolder>Properties</AppDesignerFolder>.. <RootNamespace>CEPluginLibrary</RootNamespace>.. <AssemblyName>CEPluginExample</AssemblyName>.. <TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>.. <FileAlignment>512</FileAlignment>.. <Deterministic>true</Deterministic>.. </PropertyGroup>.. <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-F97JC.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5253
                                                                                                                                                                                                                                            Entropy (8bit):4.220186376885213
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h4Dcz02nXVgqQUmzIxT1Y7wx7F74GwPgVK5z536uChJYqt+9UYNY:9KGpFDy7C7FwPgVcqu1NY
                                                                                                                                                                                                                                            MD5:D6A1CE4FE7D7E9321C47B5BA48BB0675
                                                                                                                                                                                                                                            SHA1:D2F7178B9607765FDBFC869EF2F3F25405E9D2E4
                                                                                                                                                                                                                                            SHA-256:F47E49AB8E84189B6C1DD2B4A018C43992B34B5E2C025B09CCE8BE9D60C58B6B
                                                                                                                                                                                                                                            SHA-512:9F4428E86FDF025D94BA897CC68B91056FF28A4BD2ED12DE2B9FEDE00D4396F3F53D05E4115D8CFD8F50B83891A7994001ED359E3A01C53C8578CD89DE5CC338
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.ComponentModel;..using System.Data;..using System.Drawing;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. public partial class PluginExampleForm : Form.. {.. MemScan ms;.. FoundList fl;.... public PluginExampleForm().. {.. InitializeComponent();.. }.... private void button1_Click(object sender, EventArgs e).. { .. MessageBox.Show("WEEEEEEE");.. GC.Collect();.. }.... .... private void MemScanDone(object sender).. {.. //called from CE's main UI thread. Problematic if the form was created using a new thread.. if (this.InvokeRequired).. { .. this.BeginInvoke(((MemScan)sender).OnScanDone,sender);.. }.. else..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-I3IM2.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4778
                                                                                                                                                                                                                                            Entropy (8bit):4.4952095990499785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Jo4h2nXV0VgqojlWXS+vx+FvDVfv6nEbvFUG7Fnm4Auzsq8tdlvuO4BVNT:9UF4ajlWXS+vx+FvDVfv6WdUGBnm4Au9
                                                                                                                                                                                                                                            MD5:B45C3E2829EED1BEB58ED85D8E27362B
                                                                                                                                                                                                                                            SHA1:9AFF1824269B8829B4903AC0DC53E7B314CAD5D0
                                                                                                                                                                                                                                            SHA-256:B16C0C45DCD137B01C6BB2ED3BBB7DECB406FDEC3D4AEBBF1F6EEB44E9039397
                                                                                                                                                                                                                                            SHA-512:771506912072FE9EB3500C9CCC9D02236B1DB579E02ECE9ABE538548B5F2FC0AD312EDF576DFCDE97F64E573D7B70B6CD73452BA426AAB1E8F31A9431942CC89
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. class PluginExample : CESDKPluginClass.. {.. public override string GetPluginName().. {.. return "C# Plugin Template for Cheat Engine 7.1+";.. }.... public override bool DisablePlugin() //called when disabled.. {.. .. return true;.. }.. .. public override bool EnablePlugin() //called when enabled.. {.. //you can use sdk here.. //sdk.lua.dostring("print('I am alive')");.. .... sdk.lua.Register("pluginexample1", MyFunction);.. sdk.lua.Register("pluginexample2", MyFunction2);.. sdk.lua.Register("pluginexample3", MyFunction3);.. sdk.lua.Register("pluginexample4", MyFunction4);.. sdk

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\c# template\is-AR9K4.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1513
                                                                                                                                                                                                                                            Entropy (8bit):5.570853751982549
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:pPEkvanEc5GgSyTA8VffAa6iAoPARiA2PAo6kA68IAvkAU8TlzbBW:pP0EmdSy8ZLlHRl19DPXvDxts
                                                                                                                                                                                                                                            MD5:8E1EECB2D6B4F579A7FE4B11361E1D96
                                                                                                                                                                                                                                            SHA1:647911F537437A80F06C1324AC9AF5843BFCFA01
                                                                                                                                                                                                                                            SHA-256:37DAA1B4FB9966A0EED6DAEBB98FAE863C92F433D97CEA90DD95107FA7F14A1A
                                                                                                                                                                                                                                            SHA-512:1BE14802B7B2C13DCAEDBFB8814C7DF011A48C27D83C249EE5C074ACD0AF2070595D8809EC1EF92A6DE1FF4BFA55B3D393A9E5390C04EEF72FD1F1952DA2CCAE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 15..VisualStudioVersion = 15.0.28307.489..MinimumVisualStudioVersion = 10.0.40219.1..Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CEPluginLibrary", "CEPluginLibrary\CEPluginLibrary.csproj", "{99772D98-3865-4E8D-BB02-A855950904F8}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Any CPU = Debug|Any CPU....Debug|x64 = Debug|x64....Release|Any CPU = Release|Any CPU....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|Any CPU.ActiveCfg = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|Any CPU.Build.0 = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|x64.ActiveCfg = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug|x64.Build.0 = Debug|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Release|Any CPU.ActiveCfg = Releas

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\cepluginsdk.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21249
                                                                                                                                                                                                                                            Entropy (8bit):5.473071232947375
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:MxdQ1dn5s8SJRF6A64O0pgwzG1AXQpmwpN6NnES1sq9X5T:Mxu5s8Kq0pgh1AXKbcnEMT
                                                                                                                                                                                                                                            MD5:E4FFD1E2C206AEB1FC1B8ACB2D2FFC38
                                                                                                                                                                                                                                            SHA1:A13B6AEF7AA457D47F2745924D4808DAAAB7A809
                                                                                                                                                                                                                                            SHA-256:B6500DF1E94D7BB011B38E173B2603197B7A1F304496D751EDE82E57E36E532F
                                                                                                                                                                                                                                            SHA-512:25BAC2C4782B15B86BD5940232B91A1227C286979B93E2F5A8129814AFC619AB6A57B8EF6EA60E92B78B16CDEE39098E8CD0129020E73D3A8872AA2421834833
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*.. cepluginsdk.h.. Updated July 4, 2017.... v5.0.0..*/..#ifndef CEPLUGINSDK_H..#define CEPLUGINSDK_H....#include <windows.h>..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"......#define CESDK_VERSION 6....typedef enum {ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8} PluginType;..typedef enum {aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3} AutoAssemblerPhase;....typedef struct _PluginVersion..{.. unsigned int version; //write here the minimum version this dll is compatible with (Current supported version: 1 and 2: this SDK only describes 2).. char *pluginname; //make this point to a 0-terminated string (allocated memory or static addressin your dll, not stack)..} PluginVersion, *PPluginVersion;....typedef struct _PLUGINTYPE0_RECORD..{.. char *interpretedaddress; //pointer to a 255 bytes long string (0 terminated).. UINT_P

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\cepluginsdk.pas (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20820
                                                                                                                                                                                                                                            Entropy (8bit):4.9478688580965615
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:BxYxU2LDxW7ZTDfKZeiH22CT3oQf/JQeYX9L:BxYxUauZICT4Qf/JQewL
                                                                                                                                                                                                                                            MD5:940913A8A7D44DFAD443E831137C8E56
                                                                                                                                                                                                                                            SHA1:4D0BFF7E0F6D917A5DAEBAF092B81BD8BD1C796D
                                                                                                                                                                                                                                            SHA-256:CDA5269F441120E5A3BFF2F87E289CD71DE9158CA2A619C7D0A734EB98EE6052
                                                                                                                                                                                                                                            SHA-512:3A74F73FD1CEFD89303689AA1907539377D1AAA4D94761FE4EDBBFB9FF08359733A08C388036A8D4452CE10AB8DA80D87A76816030170C2E0B4E9CF4788CA849
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:unit cepluginsdk; //more an api than sdk....{$MODE Delphi}....interface....uses windows, sysutils;....type.. TColor=dword;.. PColor=^TColor;....{$ifndef fpc}..//if old delphi then define the ptruint type..type ptruint=dword;..type pptruint=^ptruint'..{$endif}....const PluginVersionSDK=6;....type TAutoAssemblerPhase=(aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3);..type TPluginType=(ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8);....type TDWordArray = array[0..0] of DWord;.. PDWordArray = ^TDWordArray;....type.. TContinueOption = (co_run=0, co_stepinto=1, co_stepover=2, co_runtill=3);....type.. TBreakpointMethod = (bpmInt3, bpmDebugRegister);....type.. TBreakOption = (bo_Break = 0, bo_ChangeRegister = 1, bo_FindCode = 2, bo_FindWhatCodeAccesses = 3, bo_BreakAndTrace=4);.. TBreakPointAction = TBreakOption;....type.. TBreakp

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\bla.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):77
                                                                                                                                                                                                                                            Entropy (8bit):4.1648042349100605
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:UydlFeWIH9y+SNf69JEfo7PKy:U/Xw+SNf6rEMKy
                                                                                                                                                                                                                                            MD5:A5D7FBE6A1C5EE5C9B8CC1DD85195A4B
                                                                                                                                                                                                                                            SHA1:F755644CD5430ECDBC20BD52A79E1D503694D223
                                                                                                                                                                                                                                            SHA-256:49848186572123D3E61B289BD7651DBAB6F130B71C820B3472A2F896B39BB15F
                                                                                                                                                                                                                                            SHA-512:AD51E7400AB2AFAE7CC118D859EF623C47D92B81622F05CA1C1BA6D4DF3693B664F52A7F80AF3B7A96119658000B10187F62F0D483A263786C2992363ED1770B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..class weee {.. public:... int abc;.... private:... int bla;....};*/..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.c (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6621
                                                                                                                                                                                                                                            Entropy (8bit):5.329177353184485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:yRhA+IF/NIkm/SM1AnPqLxFohmeZEAdyaWWFVTc7dEug67ok:yRaPeSPACmyTyxxr
                                                                                                                                                                                                                                            MD5:9B4403AD7DFC92D6E7D8BE8A4F9C6D76
                                                                                                                                                                                                                                            SHA1:55F4E162DC4353B157A94071ED4387646265FE8B
                                                                                                                                                                                                                                            SHA-256:A7E319FF2484A156A3B027AC3A0A687EF19F878BE7CC07C06D3A98CD2F16F48F
                                                                                                                                                                                                                                            SHA-512:1D77505357B8FE48A6FBF6BE560A33F8FF31353E521D449EBE714A77320D3D98BB3111956AE29C1FE37CD4D5A8FDE2462A7F1F7476D09436730A0F218DBE97ED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// example-c.cpp : Defines the entry point for the DLL application...//....//#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers..// Windows Header Files:......#include <windows.h>..#include <stdio.h>..#include "cepluginsdk.h"..#include "bla.h"....int selfid;..int memorybrowserpluginid=-1; //initialize it to -1 to indicate failure (used by the DisablePlugin routine)..int addresslistPluginID=-1;..int debugpluginID=-1;..int ProcesswatchpluginID=-1;..int PointerReassignmentPluginID=-1;..int MainMenuPluginID=-1;....ExportedFunctions Exported;........void __stdcall mainmenuplugin(void)..{...Exported.ShowMessage("Main menu plugin");...return;..}....void __stdcall PointersReassigned(int reserved)..{...//Check the "Pointer to pointer" objects and decide if you want to redirect them to your own routine, or not...//Usefull for implementing your own read process memory and overriding user choises ...//(e.g when they pick read physical memory and you want to focus on onl

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.def (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):123
                                                                                                                                                                                                                                            Entropy (8bit):4.811779479994327
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:T8OEUpBiFc/v1JQChi02V/X1JQChsLZmQLf4lFX1JQChhXT6fW:TeyiF8tJXPKlJXcelJX3jt
                                                                                                                                                                                                                                            MD5:16E7BC7FC630EBC06C84FC437CC784AF
                                                                                                                                                                                                                                            SHA1:73EBEAE9140D391B8FC8C2A323B0DDEC2E09834F
                                                                                                                                                                                                                                            SHA-256:D8882065B6EF9E9A4B544AB301D7C1305B989C2E6DA72769F547781B5642A367
                                                                                                                                                                                                                                            SHA-512:7EA5115CFCB40DF766F98B0B19C6C7F91B29F70D76B8BF0BE86344298E22F45E46C491DDD3554ECB9C49340F778D1D1D8141351BD48EA01ECB7FCF158B0D6DED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:LIBRARY..Example-C..EXPORTS .. CEPlugin_GetVersion.@1.. CEPlugin_InitializePlugin @2.. CEPlugin_DisablePlugin @3

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.sln (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1312
                                                                                                                                                                                                                                            Entropy (8bit):5.515215172889527
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:zPEkprjnOq3v5mq3a6cq3ovq3c3q3psq3w6Sq3S8mq3iRq3P88W:zPTrjTV75bMaflv37y0UZ
                                                                                                                                                                                                                                            MD5:0DC38E698FCA8775DDFC53EB9E2777CE
                                                                                                                                                                                                                                            SHA1:031F1563637D3980AC76E7E425B82FE97E4BF8CA
                                                                                                                                                                                                                                            SHA-256:4589682CFE7932386BB7E079C63A1303CE16204FAA26A1AD754C743273A30646
                                                                                                                                                                                                                                            SHA-512:336E5D3F693479282CC73EF5AD0B88A39554990251ED1587A488B591D7E26B9431B3EF79078A89480D9ECFF9512F3FF66F249983955E4B3657E10FBC3211FE10
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.40629.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "example-c", "example-c.vcxproj", "{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Win32 = Debug|Win32....Debug|x64 = Debug|x64....Release|Win32 = Release|Win32....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|Win32.ActiveCfg = Debug|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|Win32.Build.0 = Debug|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|x64.ActiveCfg = Debug|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|x64.Build.0 = Debug|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release|Win32.ActiveCfg = Release|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release|

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.vcproj (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8651
                                                                                                                                                                                                                                            Entropy (8bit):5.1559669229373775
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Splq9zWlIHcHzp1o2q9zEa4HGE1oZq9znl/HcHzpcobq9z/a4HGEcooEtk6084bP:S+hW8SzpOhEXGEbhnFSzpWh/XGE1088
                                                                                                                                                                                                                                            MD5:EB57AF6CC5BE00BE4CCA68C11A9DD167
                                                                                                                                                                                                                                            SHA1:30766A046E9059200C7A1F834AD446413382EE8A
                                                                                                                                                                                                                                            SHA-256:58C62A39812F64D90A6B8A480E6BDCA9C42D285E77A6271F0E5F2F3E80DD668E
                                                                                                                                                                                                                                            SHA-512:B4E2D485DC6D4A4B7D2702AA62E737F136B64D3AC6DF134E04A2BB3DAEA3FB6AC7EF603B67CB14630D609A6D767BE0619F5B68A471426A8692A68FED6BA9AE16
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="example-c"...ProjectGUID="{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"...RootNamespace="example-c"...Keyword="Win32Proj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="Debug".....IntermediateDirectory="Debug".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirec

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.vcxproj (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11635
                                                                                                                                                                                                                                            Entropy (8bit):5.284575044062978
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:xY0/awSBAfNEVDyCyaL9CWyaL9CjyaL9CZyaL9CCmVurQaOnp6UTJAZpXWZAWpXP:xx/awoSuhE61pXSpXCVpX8ispX8Mj
                                                                                                                                                                                                                                            MD5:1E03374CF6182BEC5B87AD696B3B3D90
                                                                                                                                                                                                                                            SHA1:C197F285AFF272A818BB286AD06F09F7D82D41B0
                                                                                                                                                                                                                                            SHA-256:07EEC81F9ACD2497979520EE9F028735DD3BAB27312DD93ED6653B28255AA112
                                                                                                                                                                                                                                            SHA-512:E10C81E0A00C82D6C6E7582F7002484558FFD2B94D47AF69A898D4CFAC2978F23E41EDE0135ECF252B25534BBD192E0BC78788E9308C5B09E73DEC7EF6F10D82
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup Label="ProjectConfigurations">.. <ProjectConfiguration Include="Debug|Win32">.. <Configuration>Debug</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Debug|x64">.. <Configuration>Debug</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release|Win32">.. <Configuration>Release</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release|x64">.. <Configuration>Release</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. </ItemGroup>.. <PropertyGroup Label="Globals">.. <ProjectGuid>{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}</ProjectGuid>.. <RootNamespace>example-c</RootNamespace>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.vcxproj.filters (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1723
                                                                                                                                                                                                                                            Entropy (8bit):5.096113834015664
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:JdS4+lOFKMz4DFA5glIFXZ/ZaO0v1ZThRGBv3505Z9FJx3505Z9n93505Z94v355:3Qlo4aunNbR2hW/kbhE/K
                                                                                                                                                                                                                                            MD5:9740E73E7CDBD769A46179A035F59FDB
                                                                                                                                                                                                                                            SHA1:C923A13EBCD12F98BB4610AF25C833D3D2F6EC30
                                                                                                                                                                                                                                            SHA-256:DDAF1810F761922EBCC88D654AE05149C26A9A72CC6FFF0876A8BADBFA59F2B8
                                                                                                                                                                                                                                            SHA-512:3DC1CFCF7B7DAB45935E0249AA4566B68AE573A32A5987854E32C168547FB8452E0179DD7465A1BDA780E4AE416C74D4B0885C2F3DC066133D81172BFF575B53
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup>.. <Filter Include="Source Files">.. <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>.. <Extensions>cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>.. </Filter>.. <Filter Include="Header Files">.. <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>.. <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>.. </Filter>.. <Filter Include="Resource Files">.. <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>.. <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx</Extensions>.. </Filter>.. </ItemGroup>.. <ItemGroup>.. <ClCompile Include="bla.cpp">.. <Filter>Source Files</Filter>.. </ClCompile>.. <ClCompile Include="example-c.c">.. <Filter>Source Files</Filter>.. </ClCompile>.. </ItemGroup

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-1V0GB.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):123
                                                                                                                                                                                                                                            Entropy (8bit):4.811779479994327
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:T8OEUpBiFc/v1JQChi02V/X1JQChsLZmQLf4lFX1JQChhXT6fW:TeyiF8tJXPKlJXcelJX3jt
                                                                                                                                                                                                                                            MD5:16E7BC7FC630EBC06C84FC437CC784AF
                                                                                                                                                                                                                                            SHA1:73EBEAE9140D391B8FC8C2A323B0DDEC2E09834F
                                                                                                                                                                                                                                            SHA-256:D8882065B6EF9E9A4B544AB301D7C1305B989C2E6DA72769F547781B5642A367
                                                                                                                                                                                                                                            SHA-512:7EA5115CFCB40DF766F98B0B19C6C7F91B29F70D76B8BF0BE86344298E22F45E46C491DDD3554ECB9C49340F778D1D1D8141351BD48EA01ECB7FCF158B0D6DED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:LIBRARY..Example-C..EXPORTS .. CEPlugin_GetVersion.@1.. CEPlugin_InitializePlugin @2.. CEPlugin_DisablePlugin @3

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-7MEJJ.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8651
                                                                                                                                                                                                                                            Entropy (8bit):5.1559669229373775
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Splq9zWlIHcHzp1o2q9zEa4HGE1oZq9znl/HcHzpcobq9z/a4HGEcooEtk6084bP:S+hW8SzpOhEXGEbhnFSzpWh/XGE1088
                                                                                                                                                                                                                                            MD5:EB57AF6CC5BE00BE4CCA68C11A9DD167
                                                                                                                                                                                                                                            SHA1:30766A046E9059200C7A1F834AD446413382EE8A
                                                                                                                                                                                                                                            SHA-256:58C62A39812F64D90A6B8A480E6BDCA9C42D285E77A6271F0E5F2F3E80DD668E
                                                                                                                                                                                                                                            SHA-512:B4E2D485DC6D4A4B7D2702AA62E737F136B64D3AC6DF134E04A2BB3DAEA3FB6AC7EF603B67CB14630D609A6D767BE0619F5B68A471426A8692A68FED6BA9AE16
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="example-c"...ProjectGUID="{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"...RootNamespace="example-c"...Keyword="Win32Proj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="Debug".....IntermediateDirectory="Debug".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirec

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-HCP0C.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1312
                                                                                                                                                                                                                                            Entropy (8bit):5.515215172889527
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:zPEkprjnOq3v5mq3a6cq3ovq3c3q3psq3w6Sq3S8mq3iRq3P88W:zPTrjTV75bMaflv37y0UZ
                                                                                                                                                                                                                                            MD5:0DC38E698FCA8775DDFC53EB9E2777CE
                                                                                                                                                                                                                                            SHA1:031F1563637D3980AC76E7E425B82FE97E4BF8CA
                                                                                                                                                                                                                                            SHA-256:4589682CFE7932386BB7E079C63A1303CE16204FAA26A1AD754C743273A30646
                                                                                                                                                                                                                                            SHA-512:336E5D3F693479282CC73EF5AD0B88A39554990251ED1587A488B591D7E26B9431B3EF79078A89480D9ECFF9512F3FF66F249983955E4B3657E10FBC3211FE10
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.40629.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "example-c", "example-c.vcxproj", "{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug|Win32 = Debug|Win32....Debug|x64 = Debug|x64....Release|Win32 = Release|Win32....Release|x64 = Release|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|Win32.ActiveCfg = Debug|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|Win32.Build.0 = Debug|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|x64.ActiveCfg = Debug|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug|x64.Build.0 = Debug|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release|Win32.ActiveCfg = Release|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release|

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-IN5H3.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6621
                                                                                                                                                                                                                                            Entropy (8bit):5.329177353184485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:yRhA+IF/NIkm/SM1AnPqLxFohmeZEAdyaWWFVTc7dEug67ok:yRaPeSPACmyTyxxr
                                                                                                                                                                                                                                            MD5:9B4403AD7DFC92D6E7D8BE8A4F9C6D76
                                                                                                                                                                                                                                            SHA1:55F4E162DC4353B157A94071ED4387646265FE8B
                                                                                                                                                                                                                                            SHA-256:A7E319FF2484A156A3B027AC3A0A687EF19F878BE7CC07C06D3A98CD2F16F48F
                                                                                                                                                                                                                                            SHA-512:1D77505357B8FE48A6FBF6BE560A33F8FF31353E521D449EBE714A77320D3D98BB3111956AE29C1FE37CD4D5A8FDE2462A7F1F7476D09436730A0F218DBE97ED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// example-c.cpp : Defines the entry point for the DLL application...//....//#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers..// Windows Header Files:......#include <windows.h>..#include <stdio.h>..#include "cepluginsdk.h"..#include "bla.h"....int selfid;..int memorybrowserpluginid=-1; //initialize it to -1 to indicate failure (used by the DisablePlugin routine)..int addresslistPluginID=-1;..int debugpluginID=-1;..int ProcesswatchpluginID=-1;..int PointerReassignmentPluginID=-1;..int MainMenuPluginID=-1;....ExportedFunctions Exported;........void __stdcall mainmenuplugin(void)..{...Exported.ShowMessage("Main menu plugin");...return;..}....void __stdcall PointersReassigned(int reserved)..{...//Check the "Pointer to pointer" objects and decide if you want to redirect them to your own routine, or not...//Usefull for implementing your own read process memory and overriding user choises ...//(e.g when they pick read physical memory and you want to focus on onl

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-JUSL7.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11635
                                                                                                                                                                                                                                            Entropy (8bit):5.284575044062978
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:xY0/awSBAfNEVDyCyaL9CWyaL9CjyaL9CZyaL9CCmVurQaOnp6UTJAZpXWZAWpXP:xx/awoSuhE61pXSpXCVpX8ispX8Mj
                                                                                                                                                                                                                                            MD5:1E03374CF6182BEC5B87AD696B3B3D90
                                                                                                                                                                                                                                            SHA1:C197F285AFF272A818BB286AD06F09F7D82D41B0
                                                                                                                                                                                                                                            SHA-256:07EEC81F9ACD2497979520EE9F028735DD3BAB27312DD93ED6653B28255AA112
                                                                                                                                                                                                                                            SHA-512:E10C81E0A00C82D6C6E7582F7002484558FFD2B94D47AF69A898D4CFAC2978F23E41EDE0135ECF252B25534BBD192E0BC78788E9308C5B09E73DEC7EF6F10D82
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup Label="ProjectConfigurations">.. <ProjectConfiguration Include="Debug|Win32">.. <Configuration>Debug</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Debug|x64">.. <Configuration>Debug</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release|Win32">.. <Configuration>Release</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release|x64">.. <Configuration>Release</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. </ItemGroup>.. <PropertyGroup Label="Globals">.. <ProjectGuid>{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}</ProjectGuid>.. <RootNamespace>example-c</RootNamespace>..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-OK39U.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C++ source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):77
                                                                                                                                                                                                                                            Entropy (8bit):4.1648042349100605
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:UydlFeWIH9y+SNf69JEfo7PKy:U/Xw+SNf6rEMKy
                                                                                                                                                                                                                                            MD5:A5D7FBE6A1C5EE5C9B8CC1DD85195A4B
                                                                                                                                                                                                                                            SHA1:F755644CD5430ECDBC20BD52A79E1D503694D223
                                                                                                                                                                                                                                            SHA-256:49848186572123D3E61B289BD7651DBAB6F130B71C820B3472A2F896B39BB15F
                                                                                                                                                                                                                                            SHA-512:AD51E7400AB2AFAE7CC118D859EF623C47D92B81622F05CA1C1BA6D4DF3693B664F52A7F80AF3B7A96119658000B10187F62F0D483A263786C2992363ED1770B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..class weee {.. public:... int abc;.... private:... int bla;....};*/..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-UOIVF.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1723
                                                                                                                                                                                                                                            Entropy (8bit):5.096113834015664
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:JdS4+lOFKMz4DFA5glIFXZ/ZaO0v1ZThRGBv3505Z9FJx3505Z9n93505Z94v355:3Qlo4aunNbR2hW/kbhE/K
                                                                                                                                                                                                                                            MD5:9740E73E7CDBD769A46179A035F59FDB
                                                                                                                                                                                                                                            SHA1:C923A13EBCD12F98BB4610AF25C833D3D2F6EC30
                                                                                                                                                                                                                                            SHA-256:DDAF1810F761922EBCC88D654AE05149C26A9A72CC6FFF0876A8BADBFA59F2B8
                                                                                                                                                                                                                                            SHA-512:3DC1CFCF7B7DAB45935E0249AA4566B68AE573A32A5987854E32C168547FB8452E0179DD7465A1BDA780E4AE416C74D4B0885C2F3DC066133D81172BFF575B53
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup>.. <Filter Include="Source Files">.. <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>.. <Extensions>cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>.. </Filter>.. <Filter Include="Header Files">.. <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>.. <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>.. </Filter>.. <Filter Include="Resource Files">.. <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>.. <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx</Extensions>.. </Filter>.. </ItemGroup>.. <ItemGroup>.. <ClCompile Include="bla.cpp">.. <Filter>Source Files</Filter>.. </ClCompile>.. <ClCompile Include="example-c.c">.. <Filter>Source Files</Filter>.. </ClCompile>.. </ItemGroup

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-8FL6N.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21249
                                                                                                                                                                                                                                            Entropy (8bit):5.473071232947375
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:MxdQ1dn5s8SJRF6A64O0pgwzG1AXQpmwpN6NnES1sq9X5T:Mxu5s8Kq0pgh1AXKbcnEMT
                                                                                                                                                                                                                                            MD5:E4FFD1E2C206AEB1FC1B8ACB2D2FFC38
                                                                                                                                                                                                                                            SHA1:A13B6AEF7AA457D47F2745924D4808DAAAB7A809
                                                                                                                                                                                                                                            SHA-256:B6500DF1E94D7BB011B38E173B2603197B7A1F304496D751EDE82E57E36E532F
                                                                                                                                                                                                                                            SHA-512:25BAC2C4782B15B86BD5940232B91A1227C286979B93E2F5A8129814AFC619AB6A57B8EF6EA60E92B78B16CDEE39098E8CD0129020E73D3A8872AA2421834833
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*.. cepluginsdk.h.. Updated July 4, 2017.... v5.0.0..*/..#ifndef CEPLUGINSDK_H..#define CEPLUGINSDK_H....#include <windows.h>..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"......#define CESDK_VERSION 6....typedef enum {ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8} PluginType;..typedef enum {aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3} AutoAssemblerPhase;....typedef struct _PluginVersion..{.. unsigned int version; //write here the minimum version this dll is compatible with (Current supported version: 1 and 2: this SDK only describes 2).. char *pluginname; //make this point to a 0-terminated string (allocated memory or static addressin your dll, not stack)..} PluginVersion, *PPluginVersion;....typedef struct _PLUGINTYPE0_RECORD..{.. char *interpretedaddress; //pointer to a 255 bytes long string (0 terminated).. UINT_P

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-AR37R.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20820
                                                                                                                                                                                                                                            Entropy (8bit):4.9478688580965615
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:BxYxU2LDxW7ZTDfKZeiH22CT3oQf/JQeYX9L:BxYxUauZICT4Qf/JQewL
                                                                                                                                                                                                                                            MD5:940913A8A7D44DFAD443E831137C8E56
                                                                                                                                                                                                                                            SHA1:4D0BFF7E0F6D917A5DAEBAF092B81BD8BD1C796D
                                                                                                                                                                                                                                            SHA-256:CDA5269F441120E5A3BFF2F87E289CD71DE9158CA2A619C7D0A734EB98EE6052
                                                                                                                                                                                                                                            SHA-512:3A74F73FD1CEFD89303689AA1907539377D1AAA4D94761FE4EDBBFB9FF08359733A08C388036A8D4452CE10AB8DA80D87A76816030170C2E0B4E9CF4788CA849
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:unit cepluginsdk; //more an api than sdk....{$MODE Delphi}....interface....uses windows, sysutils;....type.. TColor=dword;.. PColor=^TColor;....{$ifndef fpc}..//if old delphi then define the ptruint type..type ptruint=dword;..type pptruint=^ptruint'..{$endif}....const PluginVersionSDK=6;....type TAutoAssemblerPhase=(aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3);..type TPluginType=(ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8);....type TDWordArray = array[0..0] of DWord;.. PDWordArray = ^TDWordArray;....type.. TContinueOption = (co_run=0, co_stepinto=1, co_stepover=2, co_runtill=3);....type.. TBreakpointMethod = (bpmInt3, bpmDebugRegister);....type.. TBreakOption = (bo_Break = 0, bo_ChangeRegister = 1, bo_FindCode = 2, bo_FindWhatCodeAccesses = 3, bo_BreakAndTrace=4);.. TBreakPointAction = TBreakOption;....type.. TBreakp

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-CVS0N.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):200
                                                                                                                                                                                                                                            Entropy (8bit):4.66236463636852
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jVVr02QbOwsrQl+EEKu/OrxReAEiMlAEgrlAQ0l:jVxxQCJZECueAEdlAEgrlAQy
                                                                                                                                                                                                                                            MD5:5D2DD4FF9F4C38D14220BB0E425B796C
                                                                                                                                                                                                                                            SHA1:2FD297C467FFCD72CF9CD21450E5BEAD0AE23962
                                                                                                                                                                                                                                            SHA-256:A7A47CE4CD19F703B8025696F0631C09A664D54CFA831BE4538D10441AEBB48D
                                                                                                                                                                                                                                            SHA-512:C84EC5C6F867DF99C9C8C4F57AF4795E2FACA7D81F111F7AECC568CD5A28DE3971A1BFCFEF9950181FF2FA67B82542840488DE718D95F87877F51B0709CE10D6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// lua.hpp..// Lua header files for C++..// <<extern "C">> not supplied automatically because Lua also compiles as C++....extern "C" {..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"..}..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-DMNCN.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21043
                                                                                                                                                                                                                                            Entropy (8bit):5.394919695008515
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:AmA+N/G+woUL8m7ETjv68AaMNZjXrQvLXF2ZsgcoGkR3lY6TKhaokMC5:++zbTr68AaMNZjXrQvLXF2ZsgcoGkR3T
                                                                                                                                                                                                                                            MD5:FE4F0BA514434B7F01983B97F6E517E0
                                                                                                                                                                                                                                            SHA1:7057FB0BCC204AC4E65AADDBDA350BF8F7488A3E
                                                                                                                                                                                                                                            SHA-256:0C5D09A7908F99B80377B3157A0BD37C6322CDC0AF437E99501AE746037408EC
                                                                                                                                                                                                                                            SHA-512:BEBB3A5C5384D0A08955A95970A40509D2ECE40FEEFB0A7C80BBFD4F9CF02E88AED69B5BF05BA6FFFABDD88D364BBB717AD4F59E3A1B6999BCD1CDEBDD410D53
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: luaconf.h,v 1.238 2014/12/29 13:27:55 roberto Exp $..** Configuration file for Lua..** See Copyright Notice in lua.h..*/......#ifndef luaconf_h..#define luaconf_h....#include <limits.h>..#include <stddef.h>....../*..** ===================================================================..** Search for "@@" to find all configurable definitions...** ===================================================================..*/....../*..** {====================================================================..** System Configuration: macros to adapt (if needed) Lua to some..** particular platform, for instance compiling it with 32-bit numbers or..** restricting it to C89...** =====================================================================..*/..../*..@@ LUA_32BITS enables Lua with 32-bit integers and 32-bit floats. You..** can also define LUA_32BITS in the make file, but changing here you..** ensure that all software connected to Lua will be compiled with the..** same configurati

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-DNPM0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1231
                                                                                                                                                                                                                                            Entropy (8bit):5.27341352475105
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:1i4ToLKs3cpb0gxTCLZKds9dk3kzVr4FiRok:Eaom3IVWiRok
                                                                                                                                                                                                                                            MD5:D763A23012A8DAFD2D76CE4A0609CC17
                                                                                                                                                                                                                                            SHA1:B7C2040F6EF844048A1B17E204658AD0F5C6957E
                                                                                                                                                                                                                                            SHA-256:3890F6CE73F70F6EB67EC42A74F7C8CEF40FA184659934906648C8ACADB53FBF
                                                                                                                                                                                                                                            SHA-512:9AC100782422E02809F5A63A42B9787F97C9FF292CC3EBB7E2DC39B5E40E671C566A74DEC8D1A748B7D4E8666499F045FDEE6ED4DDB0207FF7856145CBFD294E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: lualib.h,v 1.44 2014/02/06 17:32:33 roberto Exp $..** Lua standard libraries..** See Copyright Notice in lua.h..*/......#ifndef lualib_h..#define lualib_h....#include "lua.h"........LUAMOD_API int (luaopen_base) (lua_State *L);....#define LUA_COLIBNAME."coroutine"..LUAMOD_API int (luaopen_coroutine) (lua_State *L);....#define LUA_TABLIBNAME."table"..LUAMOD_API int (luaopen_table) (lua_State *L);....#define LUA_IOLIBNAME."io"..LUAMOD_API int (luaopen_io) (lua_State *L);....#define LUA_OSLIBNAME."os"..LUAMOD_API int (luaopen_os) (lua_State *L);....#define LUA_STRLIBNAME."string"..LUAMOD_API int (luaopen_string) (lua_State *L);....#define LUA_UTF8LIBNAME."utf8"..LUAMOD_API int (luaopen_utf8) (lua_State *L);....#define LUA_BITLIBNAME."bit32"..LUAMOD_API int (luaopen_bit32) (lua_State *L);....#define LUA_MATHLIBNAME."math"..LUAMOD_API int (luaopen_math) (lua_State *L);....#define LUA_DBLIBNAME."debug"..LUAMOD_API int (luaopen_debug) (lua_State *L);....#define LUA_LOADLIBNAME."pa

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-MSC6K.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:current ar archive
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30522
                                                                                                                                                                                                                                            Entropy (8bit):4.730977794432752
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:G+9VzUvXP24qb80klIfUYFXk6mN6O4teI0BhIan342:54V
                                                                                                                                                                                                                                            MD5:AAE95F62EAD4B09BAD0CDEBC9F68D8FC
                                                                                                                                                                                                                                            SHA1:6B8A2A943DEAC8E4F89E3985E04FD364B35065C8
                                                                                                                                                                                                                                            SHA-256:55B823D33C806BAAB879D3E8FD4D02253B719DCB9D4C7A74A1947AF0C99F7132
                                                                                                                                                                                                                                            SHA-512:0874A2A6D4F48EB9EBAF6FD4886ABF062EEA1F55FD2E8771B597C9EEE6666F74D44067D4074B52C5B453197D76DC575CE8608CA893F7377F9218345CBCA8BEE4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:!<arch>./ -1 0 6568 `....+..3...6...7@..p...p...p|..p|..j...j...W...W...\...\...f...f...Q...Q...Z...Z...O*..O*..\...\...P...P...Q:..Q:..kf..kf..Pj..Pj..Z...Z...]...]...M...M...j...j...iB..iB..e...e...e...e...d...d...hn..hn..g,..g,..i...i...g...g...W...W...Uj..Uj..O...O...c...c...cp..cp..c...c...T,..T,..R...R...VF..VF..Rx..Rx..aP..aP.._(.._(..]n..]n..]...]...^L..^L..b*..b*..`...`..._..._...^...^...`t..`t..`...`...nb..nb..n...n...o:..o:..l...l...dD..dD..m...m...lB..lB..m...m...m...m...k...k...N...N...L...L...b...b...Y...Y...Y@..Y@..X...X...Xh..Xh..W...W...p...p...o...o...a...a...O...O...fV..fV..j...j...V...V...LD..LD..qV..qV..M...M...q...q...M...M...?...?...D*..D*..A...A...H...H...A...A...IJ..IJ..D...D...G(..G(..J...J...B...B...;$..;$..@...@...CL..CL..Bn..Bn..B...B...Kp..Kp..Hv..Hv..:...:...:H..:H..9p..9p..H...H...G...G...9...9...8...8...F...F...En..En..;...;...FJ..FJ..<...<...E...E...<l..<l..;...;...>*..>*..=...=...=L..=L..>...>...J&..J&..I.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-QCBN5.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15219
                                                                                                                                                                                                                                            Entropy (8bit):5.2811147294549095
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:e0NdvtffvT5GDazPCagC/3hJiOY4k1gN3glwkp7MYTG26nRRT46lQHTa:lf4Dg6agC/3h8OBk7wkJMYTG1Rxqa
                                                                                                                                                                                                                                            MD5:555A7140BBD46A1B5BFD5BAC4A9A9F10
                                                                                                                                                                                                                                            SHA1:457CEE5851A018909D1BC96824E99C0C775166EE
                                                                                                                                                                                                                                            SHA-256:8AEF3FA9669BDC5E7659389E276F31EC779CA4BDF96E2C9ADA07DD9458A47416
                                                                                                                                                                                                                                            SHA-512:34B85999AA982DE19630DFA2100C60618758A4247FE5CDB3320E04904415619AA437A72E97B5E67AD287E47C66E73C7FD04DA6786DC1FCFA981207541043F3FB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: lua.h,v 1.325 2014/12/26 17:24:27 roberto Exp $..** Lua - A Scripting Language..** Lua.org, PUC-Rio, Brazil (http://www.lua.org)..** See Copyright Notice at the end of this file..*/......#ifndef lua_h..#define lua_h....#include <stdarg.h>..#include <stddef.h>......#include "luaconf.h"......#define LUA_VERSION_MAJOR."5"..#define LUA_VERSION_MINOR."3"..#define LUA_VERSION_NUM..503..#define LUA_VERSION_RELEASE."0"....#define LUA_VERSION."Lua " LUA_VERSION_MAJOR "." LUA_VERSION_MINOR..#define LUA_RELEASE.LUA_VERSION "." LUA_VERSION_RELEASE..#define LUA_COPYRIGHT.LUA_RELEASE " Copyright (C) 1994-2015 Lua.org, PUC-Rio"..#define LUA_AUTHORS."R. Ierusalimschy, L. H. de Figueiredo, W. Celes"....../* mark for precompiled code ('<esc>Lua') */..#define LUA_SIGNATURE."\x1bLua"..../* option for multiple returns in 'lua_pcall' and 'lua_call' */..#define LUA_MULTRET.(-1)....../*..** pseudo-indices..*/..#define LUA_REGISTRYINDEX.LUAI_FIRSTPSEUDOIDX..#define lua_upvalueindex(i).(LUA_REGISTR

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-SLQEM.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8689
                                                                                                                                                                                                                                            Entropy (8bit):5.0154559813237505
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:AG3SKmwE5ZD7lq4TJpTPx9W1HPHthPRHroDAtZdJ3/L:AnfEvGAr
                                                                                                                                                                                                                                            MD5:414752BF38E58BD6C662587CA7B4291A
                                                                                                                                                                                                                                            SHA1:5A82403A8D90D09E9B487AF738ECBCBC0FEEE297
                                                                                                                                                                                                                                            SHA-256:1A47911AB8C28536B35B83E9887729B06B00E10DED9C1BDB417ECE7657A6C73A
                                                                                                                                                                                                                                            SHA-512:1DC2A3C45C7FC8F8A1C5A59D6907BB03CCE53EA1E24225118190873AE8C3D28A7C4E287505D6BEEC9BB5AC28077576CEAEF04A1E2C48A0E6CBAD8DDFE8FC71D2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: lauxlib.h,v 1.128 2014/10/29 16:11:17 roberto Exp $..** Auxiliary functions for building Lua libraries..** See Copyright Notice in lua.h..*/......#ifndef lauxlib_h..#define lauxlib_h......#include <stddef.h>..#include <stdio.h>....#include "lua.h"......../* extra error code for 'luaL_load' */..#define LUA_ERRFILE (LUA_ERRERR+1)......typedef struct luaL_Reg {.. const char *name;.. lua_CFunction func;..} luaL_Reg;......#define LUAL_NUMSIZES.(sizeof(lua_Integer)*16 + sizeof(lua_Number))....LUALIB_API void (luaL_checkversion_) (lua_State *L, lua_Number ver, size_t sz);..#define luaL_checkversion(L) \... luaL_checkversion_(L, LUA_VERSION_NUM, LUAL_NUMSIZES)....LUALIB_API int (luaL_getmetafield) (lua_State *L, int obj, const char *e);..LUALIB_API int (luaL_callmeta) (lua_State *L, int obj, const char *e);..LUALIB_API const char *(luaL_tolstring) (lua_State *L, int idx, size_t *len);..LUALIB_API int (luaL_argerror) (lua_State *L, int arg, const char *extramsg);..LUALIB_API

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\is-UPK50.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:current ar archive
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):51186
                                                                                                                                                                                                                                            Entropy (8bit):5.1687334046820474
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:rJFHn1qrIxu38h8ZLE4aydYZs+1RnNqEk7/JNK2A26spyFAaNbghZGV4iwKWV8UN:/buA8ZLbYPncBQ5Rmychrr+W
                                                                                                                                                                                                                                            MD5:F22FF9845A888059D8B7F3581E43C098
                                                                                                                                                                                                                                            SHA1:766835B82B55B5254CD3CE03AF27C94CE98661AD
                                                                                                                                                                                                                                            SHA-256:CD7C6537C01CECF6CC4F71762D4D66092A51E5D99C7BA9C175988DE7308A85B9
                                                                                                                                                                                                                                            SHA-512:30A1A33B701928DD5AE8A9C7A9E2C3632E75195155936FE8D63EE26541BEBFE2F9219B6528F7E657D52DB1F6CDEB779D8FEE226B224253CED4D4EFAA349B8BD7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:!<arch>./ -1 0 14598 `....+..t...w...x@...X...X...........Z...Z...........t...t...v...v...z...z...........R...R...........,...,..........."..."...........,...,...........0...0...L...L...................d...d...........h...h...........r...r..................................."..."...........>...>...........B...B...........P...P...................p...p...................................................,...,...........2...2...........L...L...........f...f...........................T...T...........................t...t...................................n...n...........................~...~...d...d...........................................8...8...........................................f...f...:...:...........V...V...........@...@..."..."...................H...H..................|...|....@...@..{6..{6..~...~....J...J..................}...}............*...*..........}v..}v...........*...*...........:...:...........P...P...........Z...Z............

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\lauxlib.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8689
                                                                                                                                                                                                                                            Entropy (8bit):5.0154559813237505
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:AG3SKmwE5ZD7lq4TJpTPx9W1HPHthPRHroDAtZdJ3/L:AnfEvGAr
                                                                                                                                                                                                                                            MD5:414752BF38E58BD6C662587CA7B4291A
                                                                                                                                                                                                                                            SHA1:5A82403A8D90D09E9B487AF738ECBCBC0FEEE297
                                                                                                                                                                                                                                            SHA-256:1A47911AB8C28536B35B83E9887729B06B00E10DED9C1BDB417ECE7657A6C73A
                                                                                                                                                                                                                                            SHA-512:1DC2A3C45C7FC8F8A1C5A59D6907BB03CCE53EA1E24225118190873AE8C3D28A7C4E287505D6BEEC9BB5AC28077576CEAEF04A1E2C48A0E6CBAD8DDFE8FC71D2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: lauxlib.h,v 1.128 2014/10/29 16:11:17 roberto Exp $..** Auxiliary functions for building Lua libraries..** See Copyright Notice in lua.h..*/......#ifndef lauxlib_h..#define lauxlib_h......#include <stddef.h>..#include <stdio.h>....#include "lua.h"......../* extra error code for 'luaL_load' */..#define LUA_ERRFILE (LUA_ERRERR+1)......typedef struct luaL_Reg {.. const char *name;.. lua_CFunction func;..} luaL_Reg;......#define LUAL_NUMSIZES.(sizeof(lua_Integer)*16 + sizeof(lua_Number))....LUALIB_API void (luaL_checkversion_) (lua_State *L, lua_Number ver, size_t sz);..#define luaL_checkversion(L) \... luaL_checkversion_(L, LUA_VERSION_NUM, LUAL_NUMSIZES)....LUALIB_API int (luaL_getmetafield) (lua_State *L, int obj, const char *e);..LUALIB_API int (luaL_callmeta) (lua_State *L, int obj, const char *e);..LUALIB_API const char *(luaL_tolstring) (lua_State *L, int idx, size_t *len);..LUALIB_API int (luaL_argerror) (lua_State *L, int arg, const char *extramsg);..LUALIB_API

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\lua.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15219
                                                                                                                                                                                                                                            Entropy (8bit):5.2811147294549095
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:e0NdvtffvT5GDazPCagC/3hJiOY4k1gN3glwkp7MYTG26nRRT46lQHTa:lf4Dg6agC/3h8OBk7wkJMYTG1Rxqa
                                                                                                                                                                                                                                            MD5:555A7140BBD46A1B5BFD5BAC4A9A9F10
                                                                                                                                                                                                                                            SHA1:457CEE5851A018909D1BC96824E99C0C775166EE
                                                                                                                                                                                                                                            SHA-256:8AEF3FA9669BDC5E7659389E276F31EC779CA4BDF96E2C9ADA07DD9458A47416
                                                                                                                                                                                                                                            SHA-512:34B85999AA982DE19630DFA2100C60618758A4247FE5CDB3320E04904415619AA437A72E97B5E67AD287E47C66E73C7FD04DA6786DC1FCFA981207541043F3FB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: lua.h,v 1.325 2014/12/26 17:24:27 roberto Exp $..** Lua - A Scripting Language..** Lua.org, PUC-Rio, Brazil (http://www.lua.org)..** See Copyright Notice at the end of this file..*/......#ifndef lua_h..#define lua_h....#include <stdarg.h>..#include <stddef.h>......#include "luaconf.h"......#define LUA_VERSION_MAJOR."5"..#define LUA_VERSION_MINOR."3"..#define LUA_VERSION_NUM..503..#define LUA_VERSION_RELEASE."0"....#define LUA_VERSION."Lua " LUA_VERSION_MAJOR "." LUA_VERSION_MINOR..#define LUA_RELEASE.LUA_VERSION "." LUA_VERSION_RELEASE..#define LUA_COPYRIGHT.LUA_RELEASE " Copyright (C) 1994-2015 Lua.org, PUC-Rio"..#define LUA_AUTHORS."R. Ierusalimschy, L. H. de Figueiredo, W. Celes"....../* mark for precompiled code ('<esc>Lua') */..#define LUA_SIGNATURE."\x1bLua"..../* option for multiple returns in 'lua_pcall' and 'lua_call' */..#define LUA_MULTRET.(-1)....../*..** pseudo-indices..*/..#define LUA_REGISTRYINDEX.LUAI_FIRSTPSEUDOIDX..#define lua_upvalueindex(i).(LUA_REGISTR

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\lua.hpp (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):200
                                                                                                                                                                                                                                            Entropy (8bit):4.66236463636852
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:jVVr02QbOwsrQl+EEKu/OrxReAEiMlAEgrlAQ0l:jVxxQCJZECueAEdlAEgrlAQy
                                                                                                                                                                                                                                            MD5:5D2DD4FF9F4C38D14220BB0E425B796C
                                                                                                                                                                                                                                            SHA1:2FD297C467FFCD72CF9CD21450E5BEAD0AE23962
                                                                                                                                                                                                                                            SHA-256:A7A47CE4CD19F703B8025696F0631C09A664D54CFA831BE4538D10441AEBB48D
                                                                                                                                                                                                                                            SHA-512:C84EC5C6F867DF99C9C8C4F57AF4795E2FACA7D81F111F7AECC568CD5A28DE3971A1BFCFEF9950181FF2FA67B82542840488DE718D95F87877F51B0709CE10D6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:// lua.hpp..// Lua header files for C++..// <<extern "C">> not supplied automatically because Lua also compiles as C++....extern "C" {..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"..}..

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\lua53-32.lib (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:current ar archive
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30522
                                                                                                                                                                                                                                            Entropy (8bit):4.730977794432752
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:G+9VzUvXP24qb80klIfUYFXk6mN6O4teI0BhIan342:54V
                                                                                                                                                                                                                                            MD5:AAE95F62EAD4B09BAD0CDEBC9F68D8FC
                                                                                                                                                                                                                                            SHA1:6B8A2A943DEAC8E4F89E3985E04FD364B35065C8
                                                                                                                                                                                                                                            SHA-256:55B823D33C806BAAB879D3E8FD4D02253B719DCB9D4C7A74A1947AF0C99F7132
                                                                                                                                                                                                                                            SHA-512:0874A2A6D4F48EB9EBAF6FD4886ABF062EEA1F55FD2E8771B597C9EEE6666F74D44067D4074B52C5B453197D76DC575CE8608CA893F7377F9218345CBCA8BEE4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:!<arch>./ -1 0 6568 `....+..3...6...7@..p...p...p|..p|..j...j...W...W...\...\...f...f...Q...Q...Z...Z...O*..O*..\...\...P...P...Q:..Q:..kf..kf..Pj..Pj..Z...Z...]...]...M...M...j...j...iB..iB..e...e...e...e...d...d...hn..hn..g,..g,..i...i...g...g...W...W...Uj..Uj..O...O...c...c...cp..cp..c...c...T,..T,..R...R...VF..VF..Rx..Rx..aP..aP.._(.._(..]n..]n..]...]...^L..^L..b*..b*..`...`..._..._...^...^...`t..`t..`...`...nb..nb..n...n...o:..o:..l...l...dD..dD..m...m...lB..lB..m...m...m...m...k...k...N...N...L...L...b...b...Y...Y...Y@..Y@..X...X...Xh..Xh..W...W...p...p...o...o...a...a...O...O...fV..fV..j...j...V...V...LD..LD..qV..qV..M...M...q...q...M...M...?...?...D*..D*..A...A...H...H...A...A...IJ..IJ..D...D...G(..G(..J...J...B...B...;$..;$..@...@...CL..CL..Bn..Bn..B...B...Kp..Kp..Hv..Hv..:...:...:H..:H..9p..9p..H...H...G...G...9...9...8...8...F...F...En..En..;...;...FJ..FJ..<...<...E...E...<l..<l..;...;...>*..>*..=...=...=L..=L..>...>...J&..J&..I.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\lua53-64.lib (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:current ar archive
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):51186
                                                                                                                                                                                                                                            Entropy (8bit):5.1687334046820474
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:rJFHn1qrIxu38h8ZLE4aydYZs+1RnNqEk7/JNK2A26spyFAaNbghZGV4iwKWV8UN:/buA8ZLbYPncBQ5Rmychrr+W
                                                                                                                                                                                                                                            MD5:F22FF9845A888059D8B7F3581E43C098
                                                                                                                                                                                                                                            SHA1:766835B82B55B5254CD3CE03AF27C94CE98661AD
                                                                                                                                                                                                                                            SHA-256:CD7C6537C01CECF6CC4F71762D4D66092A51E5D99C7BA9C175988DE7308A85B9
                                                                                                                                                                                                                                            SHA-512:30A1A33B701928DD5AE8A9C7A9E2C3632E75195155936FE8D63EE26541BEBFE2F9219B6528F7E657D52DB1F6CDEB779D8FEE226B224253CED4D4EFAA349B8BD7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:!<arch>./ -1 0 14598 `....+..t...w...x@...X...X...........Z...Z...........t...t...v...v...z...z...........R...R...........,...,..........."..."...........,...,...........0...0...L...L...................d...d...........h...h...........r...r..................................."..."...........>...>...........B...B...........P...P...................p...p...................................................,...,...........2...2...........L...L...........f...f...........................T...T...........................t...t...................................n...n...........................~...~...d...d...........................................8...8...........................................f...f...:...:...........V...V...........@...@..."..."...................H...H..................|...|....@...@..{6..{6..~...~....J...J..................}...}............*...*..........}v..}v...........*...*...........:...:...........P...P...........Z...Z............

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\luaconf.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21043
                                                                                                                                                                                                                                            Entropy (8bit):5.394919695008515
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:AmA+N/G+woUL8m7ETjv68AaMNZjXrQvLXF2ZsgcoGkR3lY6TKhaokMC5:++zbTr68AaMNZjXrQvLXF2ZsgcoGkR3T
                                                                                                                                                                                                                                            MD5:FE4F0BA514434B7F01983B97F6E517E0
                                                                                                                                                                                                                                            SHA1:7057FB0BCC204AC4E65AADDBDA350BF8F7488A3E
                                                                                                                                                                                                                                            SHA-256:0C5D09A7908F99B80377B3157A0BD37C6322CDC0AF437E99501AE746037408EC
                                                                                                                                                                                                                                            SHA-512:BEBB3A5C5384D0A08955A95970A40509D2ECE40FEEFB0A7C80BBFD4F9CF02E88AED69B5BF05BA6FFFABDD88D364BBB717AD4F59E3A1B6999BCD1CDEBDD410D53
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: luaconf.h,v 1.238 2014/12/29 13:27:55 roberto Exp $..** Configuration file for Lua..** See Copyright Notice in lua.h..*/......#ifndef luaconf_h..#define luaconf_h....#include <limits.h>..#include <stddef.h>....../*..** ===================================================================..** Search for "@@" to find all configurable definitions...** ===================================================================..*/....../*..** {====================================================================..** System Configuration: macros to adapt (if needed) Lua to some..** particular platform, for instance compiling it with 32-bit numbers or..** restricting it to C89...** =====================================================================..*/..../*..@@ LUA_32BITS enables Lua with 32-bit integers and 32-bit floats. You..** can also define LUA_32BITS in the make file, but changing here you..** ensure that all software connected to Lua will be compiled with the..** same configurati

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\plugins\lualib.h (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1231
                                                                                                                                                                                                                                            Entropy (8bit):5.27341352475105
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:1i4ToLKs3cpb0gxTCLZKds9dk3kzVr4FiRok:Eaom3IVWiRok
                                                                                                                                                                                                                                            MD5:D763A23012A8DAFD2D76CE4A0609CC17
                                                                                                                                                                                                                                            SHA1:B7C2040F6EF844048A1B17E204658AD0F5C6957E
                                                                                                                                                                                                                                            SHA-256:3890F6CE73F70F6EB67EC42A74F7C8CEF40FA184659934906648C8ACADB53FBF
                                                                                                                                                                                                                                            SHA-512:9AC100782422E02809F5A63A42B9787F97C9FF292CC3EBB7E2DC39B5E40E671C566A74DEC8D1A748B7D4E8666499F045FDEE6ED4DDB0207FF7856145CBFD294E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/*..** $Id: lualib.h,v 1.44 2014/02/06 17:32:33 roberto Exp $..** Lua standard libraries..** See Copyright Notice in lua.h..*/......#ifndef lualib_h..#define lualib_h....#include "lua.h"........LUAMOD_API int (luaopen_base) (lua_State *L);....#define LUA_COLIBNAME."coroutine"..LUAMOD_API int (luaopen_coroutine) (lua_State *L);....#define LUA_TABLIBNAME."table"..LUAMOD_API int (luaopen_table) (lua_State *L);....#define LUA_IOLIBNAME."io"..LUAMOD_API int (luaopen_io) (lua_State *L);....#define LUA_OSLIBNAME."os"..LUAMOD_API int (luaopen_os) (lua_State *L);....#define LUA_STRLIBNAME."string"..LUAMOD_API int (luaopen_string) (lua_State *L);....#define LUA_UTF8LIBNAME."utf8"..LUAMOD_API int (luaopen_utf8) (lua_State *L);....#define LUA_BITLIBNAME."bit32"..LUAMOD_API int (luaopen_bit32) (lua_State *L);....#define LUA_MATHLIBNAME."math"..LUAMOD_API int (luaopen_math) (lua_State *L);....#define LUA_DBLIBNAME."debug"..LUAMOD_API int (luaopen_debug) (lua_State *L);....#define LUA_LOADLIBNAME."pa

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):205720
                                                                                                                                                                                                                                            Entropy (8bit):6.5406944146931805
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KNyaW1Pg7kFtOp8+vRha0DAyheYn13qaIhRFXOucMEx33sOZrcOo:KNyal78m8+vRMEe4a4OEtTi
                                                                                                                                                                                                                                            MD5:6E00495955D4EFAAC2E1602EB47033EE
                                                                                                                                                                                                                                            SHA1:95C2998D35ADCF2814EC7C056BFBE0A0EB6A100C
                                                                                                                                                                                                                                            SHA-256:5E24A5FE17EC001CAB7118328A4BFF0F2577BD057206C6C886C3B7FB98E0D6D9
                                                                                                                                                                                                                                            SHA-512:2004D1DEF322B6DD7B129FE4FA7BBE5D42AB280B2E9E81DE806F54313A7ED7231F71B62B6138AC767288FEE796092F3397E5390E858E06E55A69B0D00F18B866
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...G ........)...........0...............................@..........................................@.......P........................g......."......................................................h............................text... ........................... ..`.data........0......................@....rdata..._...P...`...*..............@..@.bss.....)...............................CRT................................@....idata..=...........................@....edata..@...........................@..@.reloc...".......$..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):262552
                                                                                                                                                                                                                                            Entropy (8bit):6.029187209935358
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:JViiO5Ea9m3XJusq4opSm7Im9SC2w/iKhF58jfq65bgusSVIRZOl0vDoD4CfOMsj:JVZcWJusRPm7kCdKfkkApZt
                                                                                                                                                                                                                                            MD5:19B2050B660A4F9FCB71C93853F2E79C
                                                                                                                                                                                                                                            SHA1:5FFA886FA019FCD20008E8820A0939C09A62407A
                                                                                                                                                                                                                                            SHA-256:5421B570FBC1165D7794C08279E311672DC4F42CB7AE1CBDDCD7EEA0B1136FFF
                                                                                                                                                                                                                                            SHA-512:A93E47387AB0D327B71C3045B3964C7586D0E03DDDB2E692F6671FB99659E829591D5F23CE7A95683D82D239BA7D11FB5A123834629A53DE5CE5DBA6AA714A9A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...G O......h...`...............................................J^..................................................@.......P............`...-.......g..........................................................P................................text... O.......P.................. ..`.data........`.......T..............@....rdata..l............n..............@..@.pdata...-...`.......F..............@..@.bss....h................................CRT.................t..............@....idata...............v..............@....edata..@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\standalonephase1.cepack (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):28924
                                                                                                                                                                                                                                            Entropy (8bit):7.991784495689372
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:SSHnnhPVVYCzrpCuqOMWlPLe1uvY1R78Occgok:SSHnnJDXZY1RgOccK
                                                                                                                                                                                                                                            MD5:FE3637780172B207CB31BB3DC612CD34
                                                                                                                                                                                                                                            SHA1:B65FA4078DCB813EBBA16784C80BC7A0E71025DD
                                                                                                                                                                                                                                            SHA-256:080A0AE9634FB07F2E9B1DDEA31491564195865DCD2B6201E1A10A13E8CDD5E9
                                                                                                                                                                                                                                            SHA-512:8F1DA48E6F224B7E7E6EF26D11D3C484A254E9A335DA9E59B837A81F9B7DB501039F31EF9AD055A07BB139BC1147C114923742C3204156AE3371A0F225A433CC
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:CEPACK......x.E.0..$.0I..`.........M......&...!.w...eC7.J .q.)Zq..u..^Y...z..+?.8C0!..T@A.k......0..s.g.......<....%.tuU.:u...SU..+...9.......3......./}...WS.....).{.Y....g..?....?...L...C9..Os..iN."w.O~..[..Rsc8~.u....3.....<s....L+s...+...3.3...............3s.{..^.s-..'.-0%r.n..2...%.F.R8.I..a.LxX..|...=...ci...cb....&.v41@..t...gy..V.7..a.....r..\..k...\j...o..Z/.{..#..Xc......xPz..2...>.~.....:n5...7..x.....Z.....n..+.....h.....t............W....j.8..m.s.k/.e\..Jc}.. W......:8z....C.i[s..9..qz.........[Z6.~.k..7....!...Tk....u...;8m3.U....|.y_.+x...A..f@6...p........I.....z..<.p.L.@.K?.a.0..O....... ..f..d0.w.>N-..E.w...L.-.b.g....{..K@.....gf.T (>.&.c..)o)7aQ#$.<.@2;.Y.......u.Wu.-....J.\hv.j..V..,.Kv.2.s.N...g.X......mf@P.....k....Q..../...Fj.5.........X{h............r...`.q+U.\.=..,Yf..).....dV..a..m.@..'iQVP....e..3.../v`@{ ..<C&...||........3..7....<.)....u+6:2.V..{......B.]ibU.r.........H*.ea..M.E.ct.m.r.+}f..X2 . ...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\standalonephase2.cepack (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):99199
                                                                                                                                                                                                                                            Entropy (8bit):7.9924368254113025
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:1536:CGNxLS1cRzW1Dx15WXGNp7u4A3AP6ovMlJEyWYykDQdTkQRWMJv2kXWMFopxLZq5:QcFW1DdDrTP6o0jEyERskXepHqz9
                                                                                                                                                                                                                                            MD5:EC8679FCB11314E333F6518113F1D71E
                                                                                                                                                                                                                                            SHA1:F6642D2551238733324141810B12C964FFE3B518
                                                                                                                                                                                                                                            SHA-256:45CFE56AE9CBB58FC51700425A19771C87029F63CB1A96CB258AEBE6AEE9D37A
                                                                                                                                                                                                                                            SHA-512:71EF7CBACD90317D32B0E4E81F64B6A4BABF644A1391396E9FF6C000C902660CFE87E5A86DF456EF5FB2DE0E6688BBF0778AB917D98BC86FB81AEA658672B4DB
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:CEPACK.....}}|S.....m....B..k...U7.....Q.@..u.a...V.`...zz..6.~u..'.lCe...(i...2M)....dzK.F.m(.....4.....~....M..s...<.y.s.M.]>F.0..O,.0-..W.......?.....\......+.>..p].c.........9...@a......-\r...G.[......U....,c.R..1.>..O...53.fI)..7.2L..S..N..U.W..DD.|..,~...SJcz....z.,....*...4.Sz...t....lrb..G.P........}.....C..@.>..;t).......e...#.._..+.....c.i.....W......?.z..........-i.ui.U.......Z3....[.....O.b........I.....4..x.&n...h..4.bM.:M|.&.@./..h.VM|.&^.....Wk..h..i.k4....:M..o..5.:M.A.o....}.........fM|.&.U...o..wh.-..nM.....4.x@.?...5..x.&~Z..5..M<...j..M<..3...9M...5q.&....h..5.BM......i...u..|M|.&^../....2M.B._............h.k5.5.u..S...Wk.u.x.&..&.......7k.[4..6M|.&.C.oI..k./m|s.o..9....%.(.Mu..N-b..s/..!1.V.).s<~\....d...U...m..((...|._...{...y70/.A.X....b... ....@:..l3..tdT`....b...>Z*..!......~.'....G:XF...H\."....%...T.+^x~.....?b.......}S...0........+.9UP.l...........v.O..].?...6.....g1.s.i...,.0..[...<.C.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcc32-32-linux.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):386976
                                                                                                                                                                                                                                            Entropy (8bit):6.870368063282166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:359aKWK/HqY5AXeWEfv6TBr4udWNrzJD10P9TQmxhAIXiCUXEC+Y4r/w2MGkTkm/:J9WsHse9fvcBrnd8rzZ10eMhEChC+Ygi
                                                                                                                                                                                                                                            MD5:486237BC5FA41DCE8C3022B9B6221FE5
                                                                                                                                                                                                                                            SHA1:C00BA51895DEAB2054C6F0F7DD3CF397E119C6FE
                                                                                                                                                                                                                                            SHA-256:4E2C87700CCDD3B34215C6BC64AE4582AC5FF373CFD3E93E8F7D2016960BA80D
                                                                                                                                                                                                                                            SHA-512:5F4010D8F9B0C865DE209E90625F178C8A7370AF1F7BE85552147EBD9EE7D033B01DD5A277FB646E2D289D2821462ADBB0959E507CD0A044CE79CB1C526A385B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...;.6c...........!.....f...N......D.....................................................@..........................B......$F..(....................|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..t............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcc32-32.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):386976
                                                                                                                                                                                                                                            Entropy (8bit):6.870406853054738
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:e59aKWK/HqY5AXeWEfv6TBr4udWNrrJ710vFTAmJxQIfaCU/MC3O74r/wuMGFYsN:G9WsHse9fvcBrnd8rrR10WUxkCxC3O7S
                                                                                                                                                                                                                                            MD5:81633981057858F56BECB3BD316283E9
                                                                                                                                                                                                                                            SHA1:F6981034B1A5E23766BA4D40D451D784A1CFF83E
                                                                                                                                                                                                                                            SHA-256:4885754E6AC08304858383E47D3ADA425409988871BA6586151143D511488614
                                                                                                                                                                                                                                            SHA-512:99886CB451EAE690657AC848B63D58CD8B436849F6D073C5C073B624A6956397AC5AB6B636B1970C60DCE4EB5B3512372A4EC79FC28E9397AFE7D0791466D0A3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...0.6c...........!.....f...N......D.....................................................@.........................pB.......F..(....................|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..`............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcc64-32-linux.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):443296
                                                                                                                                                                                                                                            Entropy (8bit):6.630155817797785
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:bdQpG4IhjOSudLX4PGUGTdVwYr9ABfpMqYFOso5WMKYnTrLxWAld/wydfCigAA:apG4w5upwGTv9GWov1nlVAV
                                                                                                                                                                                                                                            MD5:0C7D89B75430A40824A5D7B79890324E
                                                                                                                                                                                                                                            SHA1:7E03E3D5386B1ED49104C3B35E44A545863BCBB9
                                                                                                                                                                                                                                            SHA-256:6B21B24279309F4117F8E39CDAF940F645C15D92442990A77655C8F898BB2227
                                                                                                                                                                                                                                            SHA-512:31453A2575FD7674AC7802DC8F740C79D357AD3464869F6EFD5E4A3892114EE9767715EBCA0D39E5B39CA8DA7BFED7E671D3EB24DBFB698C57ECA196D4FDFC85
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.mD............i.......i.......i........K......^.......^.......^.......i...........R...................................Rich............PE..d...8.6c.........." ................ %..............................................`{....`.........................................`........!..(................1...X...k...... .......p............................................................................text............................... ..`.rdata...).......*..................@..@.data...RX...0......................@....pdata...1.......2..................@..@.rsrc................N..............@..@.reloc.. ............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcc64-32.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):446368
                                                                                                                                                                                                                                            Entropy (8bit):6.635233277412147
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:aSn7zUunHkqypGYKKOyt8GMyKw0ORVdPpEPwkdRHhvOOZoU/wC/cQBi4Blb:nzU8E9GDWKMRPAZhvpoUOo
                                                                                                                                                                                                                                            MD5:069EC7832ADBF93BD04A91B07FF00D78
                                                                                                                                                                                                                                            SHA1:5ED84D13FFCEF487EB039CD75DE91294C25ED0CC
                                                                                                                                                                                                                                            SHA-256:8C8C608AE67F8B8A4E56DAF2EDEA1A92CBA6866D4F324BD0E5AD1284126849A7
                                                                                                                                                                                                                                            SHA-512:D9E9D40DE2509B112762ADE7EF0BB6DB91EB5687AE6EA9689ABD7A7AF8BA601297655587EEF34F7D1DAC62D77E5B586BE71B19F044EBF53028CFE90DDCE776F8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................8...Fk...................................................S...........Rich...........................PE..d...=.6c.........." ......................................................................`..........................................'.......*..(................1...d...k..............p............................................................................text...`........................... ..`.rdata...3.......4..................@..@.data....X...@......................@....pdata...1.......2...(..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcc64-64-linux.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):456096
                                                                                                                                                                                                                                            Entropy (8bit):6.635086574093954
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:tTaB+hAvavjZihpuXh9js6zMxfdKCXbRRUsQHoh3+KZ+a3cnldkEBX/zrMMZKUjo:haBtvavY6XhNrzSk2gxQ3Wn7kw3o
                                                                                                                                                                                                                                            MD5:AA97F366592E0FA41D2D2F61765CA7D5
                                                                                                                                                                                                                                            SHA1:BE85DAF3B07E66225CD4167F96ED6292CCE54E1E
                                                                                                                                                                                                                                            SHA-256:D63036771F21AE7E056F2211CB560BFCF79ADE356B59D8F462050B2DD840E86C
                                                                                                                                                                                                                                            SHA-512:F16D3F899504EF556D186BEBE1A526D9999454AB60697CDE221130720AB8154003543A62C4E53124C902E51FCF62B653C914B316DA0E3766DF5026E386DD47CC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......HJjD.+...+...+..iM...+..iM...+..iM...+.......+..^C...+..^C...+..^C...+..iM...+...+..S+...B...+...B...+...B...+...B...+..Rich.+..........................PE..d...3.6c.........." ................@P..............................................C.....`..........................................C......4G..(................3.......k......$... ...p............................................ ...............................text...p........................... ..`.rdata.../... ...0..................@..@.data...jX...P.......@..............@....pdata...3.......4...L..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcc64-64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):455072
                                                                                                                                                                                                                                            Entropy (8bit):6.627282046325032
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:8NqQopGY6gsnGubx5JbmZl2Wjm+9498RkaGlef/AYbAPrqEThN0dWI/mo1pdUMMe:fQoIfvxCc64fauA0lhydIo1AfDW
                                                                                                                                                                                                                                            MD5:E8DFC0D2D41483C7725E4EBB7E32D324
                                                                                                                                                                                                                                            SHA1:B2890C91EFBA390B68E481CD2EE311136B740EDE
                                                                                                                                                                                                                                            SHA-256:1172F2D7B1FB34408C8FFC248E3E719922843EA07BD5B409BE3405D1C300B3F7
                                                                                                                                                                                                                                            SHA-512:539A1BD18D4753D69756B9B7E6603DD6E7A3F354CA002DECE206F7E2F1E2792704F3D80F38B37C0C41F16A1FD9DE32CC4DD5873959D762C5AA13388715EE7803
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................8...Fi...................................................Q...........Rich...........PE..d...5.6c.........." ................P5...............................................h....`..........................................<.......?..(...............d2.......k..............p...........................p................................................text............................... ..`.rdata...8.......:..................@..@.data....X...P.......<..............@....pdata..d2.......4...H..............@..@.rsrc................|..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcc64-aarch64-linux.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1113504
                                                                                                                                                                                                                                            Entropy (8bit):5.932626447270598
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:3+hKmLazchlUT5PzJXmGFYKUeMzkMz7S480UJ+RNdO24a/s0X4G:Uy4n8VWGQdS480U4RN20X4G
                                                                                                                                                                                                                                            MD5:CCD151D8EE8ED05AA0E1D9142FD6E438
                                                                                                                                                                                                                                            SHA1:8D343BBC1A6F2D5D9ED8813427635696291C8F0D
                                                                                                                                                                                                                                            SHA-256:5C929F453DB7F0703BC8F939E39D48C79ECAB9E453918E5D0CD136C8026474CC
                                                                                                                                                                                                                                            SHA-512:DCB0B9A9B2908D5D55214F6A261B0A8C08889603CFABC327A7A82387012925BBF486B5C28B5250E9449FF9758748A021023C99EE02B59ABBB7B3C979A06DAEB4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0.Z't.4tt.4tt.4t..0ux.4t..7ur.4t..1u.4t.3.t~.4t&.1ui.4t&.0ue.4t&.7u~.4t..5uw.4tt.5t).4t..0uu.4t..1uu.4t..4uu.4t...tu.4t..6uu.4tRicht.4t........PE..d.....6c.........." .....\..........o........................................ ............`.............................................d......(.......<.......\........k..........@...8............................................................................textbss.A...............................text....Z...`...\.................. ..`.rdata...@.......B...`..............@..@.data...............................@....pdata..X...........................@..@.idata..r............Z..............@..@.msvcjmc8............l..............@....00cfg...............n..............@..@.rsrc...<............p..............@..@.reloc..7............v..............@..B................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\COPYING (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26932
                                                                                                                                                                                                                                            Entropy (8bit):4.662099291681256
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:cjWBIk+x/vIqk0TkX6sT6AATeINgKP+nHQ41fgcmmItyOQeM9YfWEeHBvo0:ciBJsFkOTeDnLqFXTfleHBvo0
                                                                                                                                                                                                                                            MD5:72B6BD92AB82F8774BBBB73C217C57B6
                                                                                                                                                                                                                                            SHA1:86D1215F2E127BFFD94F7B7BE6F7C4CE94ACDDA8
                                                                                                                                                                                                                                            SHA-256:9B183E7F0356C398CC0A65C4A2D2CD56F2149A8E244264C4D26AC59E9DADA3E8
                                                                                                                                                                                                                                            SHA-512:504E32EEBF7F3FDF37BB354F8B32BA9BB0810B490563AC5E8E58EF8BB3844A196706C8A25335E71A3D2E70C1C6C6304A6AEC7A9EFB309E89EEA89F6D9607A437
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.. GNU LESSER GENERAL PUBLIC LICENSE.... Version 2.1, February 1999.... Copyright (C) 1991, 1999 Free Software Foundation, Inc... 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed.....[This is the first released version of the Lesser GPL. It also counts.. as the successor of the GNU Library Public License, version 2, hence.. the version number 2.1.]....... Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..Licenses are intended to guarantee your freedom to share and change..free software--to make sure the software is free for all its users..... This license, the Lesser General Public License, applies to some..specially designated software packages--typically libraries--of the..Free Software Foundation and other authors who decide to use it. You..can

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\RELICENSING (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2763
                                                                                                                                                                                                                                            Entropy (8bit):4.679490275459229
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:wmINs5JslcE338QHFs5DGT93oVFl/9OsmONbs+2y:w7/Tn8QHDonOsJhs+
                                                                                                                                                                                                                                            MD5:0006E501494FE7AAC40035AD1E9B84A9
                                                                                                                                                                                                                                            SHA1:4D885BAA2024FA1CE2DF99041EC4B0D046549587
                                                                                                                                                                                                                                            SHA-256:B8CA96FA5251F2449F47F5E62E5B7C54A0D0DBCA353627D1C67A8B2CC71958E0
                                                                                                                                                                                                                                            SHA-512:BFF444F24836B3D85E734F4FE11FFDFD095E4F1386D54E4C934EDD3B9162E6D92BA0939103BDCC3B708D6296B9C268DDD77E4B63322A429DD4782202D754831C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.. Relicensing TinyCC.. ------------------.... The authors listed below hereby confirm their agreement to relicense TinyCC.. including their past contributions under the following terms:...... * Permission is hereby granted, free of charge, to any person obtaining a copy.. * of this software and associated documentation files (the "Software"), to deal.. * in the Software without restriction, including without limitation the rights.. * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.. * copies of the Software, and to permit persons to whom the Software is.. * furnished to do so, subject to the following conditions:.. *.. * The above copyright notice and this permission notice shall be included in.. * all copies or substantial portions of the software... *.. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEM

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\REST (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):119
                                                                                                                                                                                                                                            Entropy (8bit):4.371155522109906
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:GACoYQZGhzeF7FEd2NAFNMLAdS4INMLAKQvI+IEQtM0KRvMH:SorZGIF72gNAFNM0deNM0tI+IEQ+0KmH
                                                                                                                                                                                                                                            MD5:7C3537668B4B35F486F199AF30768340
                                                                                                                                                                                                                                            SHA1:611F489364DF2A1D404022ECFCF6BB028103CC19
                                                                                                                                                                                                                                            SHA-256:5F58445C525B6BE19809AA19D69067C1910EDF90A9C56A508571A56EE4CDB5F1
                                                                                                                                                                                                                                            SHA-512:FD3EC07B964BB66C604BFB55A7701951E47CCA13D9AC5811F35BE6EFF8C81745A7AB62F3A22393B1D5AF303702943B2FAB7C499BFA6037C8B79396C98A39D27B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:The rest of this project can be found at https://github.com/cheat-engine/cheat-engine/tree/master/Cheat%20Engine/tcclib

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\is-4J19G.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26932
                                                                                                                                                                                                                                            Entropy (8bit):4.662099291681256
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:cjWBIk+x/vIqk0TkX6sT6AATeINgKP+nHQ41fgcmmItyOQeM9YfWEeHBvo0:ciBJsFkOTeDnLqFXTfleHBvo0
                                                                                                                                                                                                                                            MD5:72B6BD92AB82F8774BBBB73C217C57B6
                                                                                                                                                                                                                                            SHA1:86D1215F2E127BFFD94F7B7BE6F7C4CE94ACDDA8
                                                                                                                                                                                                                                            SHA-256:9B183E7F0356C398CC0A65C4A2D2CD56F2149A8E244264C4D26AC59E9DADA3E8
                                                                                                                                                                                                                                            SHA-512:504E32EEBF7F3FDF37BB354F8B32BA9BB0810B490563AC5E8E58EF8BB3844A196706C8A25335E71A3D2E70C1C6C6304A6AEC7A9EFB309E89EEA89F6D9607A437
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.. GNU LESSER GENERAL PUBLIC LICENSE.... Version 2.1, February 1999.... Copyright (C) 1991, 1999 Free Software Foundation, Inc... 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed.....[This is the first released version of the Lesser GPL. It also counts.. as the successor of the GNU Library Public License, version 2, hence.. the version number 2.1.]....... Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..Licenses are intended to guarantee your freedom to share and change..free software--to make sure the software is free for all its users..... This license, the Lesser General Public License, applies to some..specially designated software packages--typically libraries--of the..Free Software Foundation and other authors who decide to use it. You..can

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\is-8Q4O2.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):119
                                                                                                                                                                                                                                            Entropy (8bit):4.371155522109906
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:GACoYQZGhzeF7FEd2NAFNMLAdS4INMLAKQvI+IEQtM0KRvMH:SorZGIF72gNAFNM0deNM0tI+IEQ+0KmH
                                                                                                                                                                                                                                            MD5:7C3537668B4B35F486F199AF30768340
                                                                                                                                                                                                                                            SHA1:611F489364DF2A1D404022ECFCF6BB028103CC19
                                                                                                                                                                                                                                            SHA-256:5F58445C525B6BE19809AA19D69067C1910EDF90A9C56A508571A56EE4CDB5F1
                                                                                                                                                                                                                                            SHA-512:FD3EC07B964BB66C604BFB55A7701951E47CCA13D9AC5811F35BE6EFF8C81745A7AB62F3A22393B1D5AF303702943B2FAB7C499BFA6037C8B79396C98A39D27B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:The rest of this project can be found at https://github.com/cheat-engine/cheat-engine/tree/master/Cheat%20Engine/tcclib

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\is-QKIFN.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2763
                                                                                                                                                                                                                                            Entropy (8bit):4.679490275459229
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:wmINs5JslcE338QHFs5DGT93oVFl/9OsmONbs+2y:w7/Tn8QHDonOsJhs+
                                                                                                                                                                                                                                            MD5:0006E501494FE7AAC40035AD1E9B84A9
                                                                                                                                                                                                                                            SHA1:4D885BAA2024FA1CE2DF99041EC4B0D046549587
                                                                                                                                                                                                                                            SHA-256:B8CA96FA5251F2449F47F5E62E5B7C54A0D0DBCA353627D1C67A8B2CC71958E0
                                                                                                                                                                                                                                            SHA-512:BFF444F24836B3D85E734F4FE11FFDFD095E4F1386D54E4C934EDD3B9162E6D92BA0939103BDCC3B708D6296B9C268DDD77E4B63322A429DD4782202D754831C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.. Relicensing TinyCC.. ------------------.... The authors listed below hereby confirm their agreement to relicense TinyCC.. including their past contributions under the following terms:...... * Permission is hereby granted, free of charge, to any person obtaining a copy.. * of this software and associated documentation files (the "Software"), to deal.. * in the Software without restriction, including without limitation the rights.. * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.. * copies of the Software, and to permit persons to whom the Software is.. * furnished to do so, subject to the following conditions:.. *.. * The above copyright notice and this permission notice shall be included in.. * all copies or substantial portions of the software... *.. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEM

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\lib\is-S6F9T.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13913
                                                                                                                                                                                                                                            Entropy (8bit):5.0625346433631195
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:r19A/cZMTI5yb/KekUbGXiTYli8hcHPHuwGX9Gln4FmgopA:r19i5x/8hEfuTGQCm
                                                                                                                                                                                                                                            MD5:BDE9BB4FFF437414B38B1FEB2E8C5A0A
                                                                                                                                                                                                                                            SHA1:8CC60A152FA9FAABD63980977F93230AD4462FF2
                                                                                                                                                                                                                                            SHA-256:E656129DB32DD84EEB1BCE8CE9E6296943F1920EDB6E9296F67A5986E3C84E6E
                                                                                                                                                                                                                                            SHA-512:91653AEDFADA80F62D2906A09671932D9603CA884BC09B5BCE0317A29DF934252C7AC3BF6557399C642F010BE2ADDC90E96EA87EC5F3DC2AFEAD491F1E27BC39
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/* TCC runtime library. .. Parts of this code are (c) 2002 Fabrice Bellard .... Copyright (C) 1987, 1988, 1992, 1994, 1995 Free Software Foundation, Inc.....This file is free software; you can redistribute it and/or modify it..under the terms of the GNU General Public License as published by the..Free Software Foundation; either version 2, or (at your option) any..later version.....In addition to the permissions in the GNU General Public License, the..Free Software Foundation gives you unlimited permission to link the..compiled version of this file into combinations with other programs,..and to distribute those combinations without any restriction coming..from the use of this file. (The General Public License restrictions..do apply in other respects; for example, they cover modification of..the file, and distribution when not linked into a combine..executable.)....This file is distributed in the hope that it will be useful, but..WITHOUT ANY WARRANTY; without even the implied warra

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tcclib\lib\libtcc1.c (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13913
                                                                                                                                                                                                                                            Entropy (8bit):5.0625346433631195
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:r19A/cZMTI5yb/KekUbGXiTYli8hcHPHuwGX9Gln4FmgopA:r19i5x/8hEfuTGQCm
                                                                                                                                                                                                                                            MD5:BDE9BB4FFF437414B38B1FEB2E8C5A0A
                                                                                                                                                                                                                                            SHA1:8CC60A152FA9FAABD63980977F93230AD4462FF2
                                                                                                                                                                                                                                            SHA-256:E656129DB32DD84EEB1BCE8CE9E6296943F1920EDB6E9296F67A5986E3C84E6E
                                                                                                                                                                                                                                            SHA-512:91653AEDFADA80F62D2906A09671932D9603CA884BC09B5BCE0317A29DF934252C7AC3BF6557399C642F010BE2ADDC90E96EA87EC5F3DC2AFEAD491F1E27BC39
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:/* TCC runtime library. .. Parts of this code are (c) 2002 Fabrice Bellard .... Copyright (C) 1987, 1988, 1992, 1994, 1995 Free Software Foundation, Inc.....This file is free software; you can redistribute it and/or modify it..under the terms of the GNU General Public License as published by the..Free Software Foundation; either version 2, or (at your option) any..later version.....In addition to the permissions in the GNU General Public License, the..Free Software Foundation gives you unlimited permission to link the..compiled version of this file into combinations with other programs,..and to distribute those combinations without any restriction coming..from the use of this file. (The General Public License restrictions..do apply in other respects; for example, they cover modification of..the file, and distribution when not linked into a combine..executable.)....This file is distributed in the hope that it will be useful, but..WITHOUT ANY WARRANTY; without even the implied warra

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\tiny.cepack (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):36018
                                                                                                                                                                                                                                            Entropy (8bit):7.994007484272608
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:9vQvLQOAupOW0bBJ8RkEgh+zhlrKlfaMfToatTCCRFxg4Oaun:9Yv1bpOW0bBJ8goVUsMfcUvzOaun
                                                                                                                                                                                                                                            MD5:927EF77EFDA84808C9088632C76843E5
                                                                                                                                                                                                                                            SHA1:AA73E4C27F8A00DF4C9B8BD05088D483B5F8FF9B
                                                                                                                                                                                                                                            SHA-256:422A2989BABB5E9512C98B3FA24C4F5A0BA9A72C3C71A920C5F979316E1674C7
                                                                                                                                                                                                                                            SHA-512:98B6BA444008B5978D65FA83487465D700D6EEE721CE8990F1D2E034945F7650E7031E4B9E18C945FE81C6919E5213750DC4E2D86829988E25A3B237559E90E8
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:CEPACK......|T.0~v.$9I69.$.$@.`.F..%.!.$....]"$`.t]..p.`%.x...a....R.....^.X..B........6...j......3gw...{.....|...{..3.<3..3..<3)...g.8....q\3...s...=.K...d...?.h6,...<.m..P...<.H.......$e|.........0.hiE.#?Z...II..a.?<p1..s.......1....hc....M...;..6:X|..Y.yc.sob...A<.....[l..~....#t....x....q...........q1.<1Q...X....l.g...u.....S...l..b..F...}......>.:_2.c....H.|0LPs..G...5..}@z...3.u..~o]G".....]..c.:.}......5..?.k..V......?...D.....o.-.......[N.)...K|2..E.f...(3..I.#..E.....3...O.Gv.R.U.....&."..y9-5...4..!.q'......%...!..N-....d.r-U..3,..3........'.0;..h....G.....IN...M...x(.,`M...t.C...?.,4..+...@...4-.>....;>.x(..K.&.B...4.IR..@RK....$-....R..g.Z*4:...R.@...Ry.J..M.q.u.hb....s%....A.r...2S.. .;.v...&....h.......4.[.._..[b(ih..@.}zi..N.K.....'u..$i.V.BR.[....F.I.....A&..........e,..)...P.%.Ui..|.oP.B..0&../_..R..N..(3...(.~9....2z...a.h.[O.h...S..[..S..F...a..v...83E9....U..~.@..b#c.;..YN %..m....E1D.t.d 6......h%....

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\unins000.dat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:InnoSetup Log 64-bit Cheat Engine, version 0x418, 67939 bytes, 965969\37\user\376, C:\Program Files\Cheat Engine 7.5\376\377\
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):67939
                                                                                                                                                                                                                                            Entropy (8bit):3.6997387420915326
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:pFKlzYQUJIvyFwu4KKENElbmrgf4JyA3ZekP:pFKlzYQUJIvy9h
                                                                                                                                                                                                                                            MD5:F3BE2033AA1903473833D1A2A1B7EFBA
                                                                                                                                                                                                                                            SHA1:38D0F354CB5DCEB16A1596E676FDCE1E638ECFE0
                                                                                                                                                                                                                                            SHA-256:84181139BFE13A3F92B075BE347CD6D130F761CF479FD51370D7DE40FE88F118
                                                                                                                                                                                                                                            SHA-512:C285EF458D2DDAB959B23E69547500DC44BAD259619096E964680CFE3A7753A31C93BBC27AC777B357A47413C2F9F1F32DE7EEEEE917B982F94B585BD8F00980
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Inno Setup Uninstall Log (b) 64-bit.............................Cheat Engine....................................................................................................................Cheat Engine........................................................................................................................v...c.....................................................................................................................@..........3........}........9.6.5.9.6.9......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5................,...j.. ......).......IFPS....&...(....................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.........TUNINSTALLSTEP.........TMSGBOXTYPE...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\unins000.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3223968
                                                                                                                                                                                                                                            Entropy (8bit):6.338087367720092
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TYfx:0HDYsqiPRhINnq95FoHVBT333T+
                                                                                                                                                                                                                                            MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
                                                                                                                                                                                                                                            SHA1:9752F38CC51314BFD6D9ACB9FB773E90F8EA0E15
                                                                                                                                                                                                                                            SHA-256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
                                                                                                                                                                                                                                            SHA-512:B0A00082C1E37EFBFC2058887DB60DABF6E9606713045F53DB450F16EBAE0296ABFD73A025FFA6A8F2DCB730C69DD407F7889037182CE46C68367F54F4B1DC8D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1......u1...@......@....................-.......-..9....................0..k....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\unins000.msg

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:InnoSetup messages, version 6.0.0, 261 messages (UTF-16), Cancel installation
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24097
                                                                                                                                                                                                                                            Entropy (8bit):3.2749730459064845
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:b1EjNSCkf3SCqsTr6CCPanAG1tznL7VF+Iqfc51U5YQDztXfbKJG/Bfvo:b1EK6CHr6fSX+7Q1U5YQDztB/B3o
                                                                                                                                                                                                                                            MD5:313D0CC5D1A64D2565E35937991775A6
                                                                                                                                                                                                                                            SHA1:B8ACB11878C485865C9E4679248E53B83A8F3AD4
                                                                                                                                                                                                                                            SHA-256:5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
                                                                                                                                                                                                                                            SHA-512:7C2DB4A3A4A8DF09F8119A7BA4CA9EBFE562F0A34D431928344E21A5853931EEFBFD910DC4026C6788AC22423BBB125F2B700326D8A1D82B134E2B486C3D0684
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Inno Setup Messages (6.0.0) (u)......................................]..+..... .C.a.n.c.e.l. .i.n.s.t.a.l.l.a.t.i.o.n...S.e.l.e.c.t. .a.c.t.i.o.n...&.I.g.n.o.r.e. .t.h.e. .e.r.r.o.r. .a.n.d. .c.o.n.t.i.n.u.e...&.T.r.y. .a.g.a.i.n...&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):332704
                                                                                                                                                                                                                                            Entropy (8bit):6.512223997122371
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:UokW02RSGoOZQcW2jS95cM0EsZjv8trtH3Vizwy:ZkW02RsOKcWnDdMv8trtX0
                                                                                                                                                                                                                                            MD5:E9B5905D495A88ADBC12C811785E72EC
                                                                                                                                                                                                                                            SHA1:CA0546646986AAB770C7CF2E723C736777802880
                                                                                                                                                                                                                                            SHA-256:3EB9CD27035D4193E32E271778643F3ACB2BA73341D87FD8BB18D99AF3DFFDEA
                                                                                                                                                                                                                                            SHA-512:4124180B118149C25F8EA8DBBB2912B4BD56B43F695BF0FF9C6CCC95ADE388F1BE7D440A791D49E4D5C9C350EA113CF65F839A3C47D705533716ACC53DD038F8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........D(..$-..................................................P...........................................d........................k.......:..................................................P................................text............................... ..`.data...D(.......*..................@....rdata..............................@..@.bss....$-...p...........................CRT.................Z..............@....idata...............\..............@....edata...............j..............@..@.reloc...:.......<...l..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):423328
                                                                                                                                                                                                                                            Entropy (8bit):6.077270660749132
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:gLJXTQOQV/MzZTixW5GmL7HOf0ADMTE21gFOpJz:Q+V/M9WWnL7HOf0ADMIuR
                                                                                                                                                                                                                                            MD5:8D487547F1664995E8C47EC2CA6D71FE
                                                                                                                                                                                                                                            SHA1:D29255653AE831F298A54C6FA142FB64E984E802
                                                                                                                                                                                                                                            SHA-256:F50BAF9DC3CD6B925758077EC85708DB2712999B9027CC632F57D1E6C588DF21
                                                                                                                                                                                                                                            SHA-512:79C230CFE8907DF9DA92607A2C1ACE0523A36C3A13296CB0265329208EDC453E293D7FBEDBD5410DECF81D20A7FE361FDEBDDADBC1DC63C96130B0BEDF5B1D8A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........6...2...................................................................................................p.......P..d................H.......k..........................................................LT...............................text............................... ..`.data....6.......8..................@....rdata...V...P...X...4..............@..@.pdata...H.......J..................@..@.bss.....2...............................CRT.........@......................@....idata.......P......................@....edata.......p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\vmdisk.img (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:DOS/MBR boot sector
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):477184
                                                                                                                                                                                                                                            Entropy (8bit):5.927630308859684
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:JEgIgQUO3gqHm5DHLj7S0/Y9kwRofaqcEL5jw/ayKImdyoO:Gg/hEm5DrHE9kwRofaqcEL5jw/ayKImD
                                                                                                                                                                                                                                            MD5:036B059F8C1CC9AFF3D010E5446BB16C
                                                                                                                                                                                                                                            SHA1:450842B84E2FACE167E2D138E4F96317CB255BB3
                                                                                                                                                                                                                                            SHA-256:248F3D48664482090D2C8C01B98518777DED1D900E17ACBC077EFE17258411A6
                                                                                                                                                                                                                                            SHA-512:4BA5E167A2E3BFE92D43759642AF7BCDB6F4C9EFA30C0F9DE85D6E9758B62FC7ED89FAFDE48910E4E059080E457E3556D23CB1D59B3062C75F81DB9C59B75657
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.$.CETC2#...............>.A..............f..p....$p1...f...pf...pf...pf.6.pf.>.pf...pf.&.p.."p...&p..(p..*p.X.,p....0p. .f..}......0.......|1....?........}..............`.............6.|...?@..|.......& |.!....Q....."|.6$|...|....s......|..........u........1.."|..."|S...J.[:..|r....."|..$|..$|:..|u...$|....$|YI...Qu.Y.....|f...|......f}....0...P.P.&f}..g}...e..e.E...X..g}...f}...<.t...e..e.E.....F....f}.....Q....f.Y...`1.....t.=..t.=..t....X...@.f1........1..f.......@s.a..DBVM BS.......U......PR>..".>..#..........R........Z.&..&.D......Ps.........r...>..".>..#.ZX.....F.<$u..PRZX.PSQW....N..$N9.r.1......0..N...u..A9.r... N...._Y[X.PSQW....N..$N9.r,1.......w...0.......a..N...u..A9.r... N...._Y[X.88=$e801:$e820:..$ax=$bx=$cx=$dx=$SMAP ERROR!..$..................$................................get VESA info success..$get VESA info failed..$ Failurevideomode 0x$..1...H..&......6........&;.........t........retry reading disk..........f1.f1........]>..?.>

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\vmdisk.img.sig (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):132
                                                                                                                                                                                                                                            Entropy (8bit):6.593562490537789
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:O18qyj/0fZMX/ferOk9OWtW2kdT0PgluBKd9cCkAl8F:O10/3er/X1Y4BKtJuF
                                                                                                                                                                                                                                            MD5:A4B42FDCA7043792CCC37C611DB21075
                                                                                                                                                                                                                                            SHA1:17CBF2EC6ECA6BD0CAF1DA78AF51D9F363151168
                                                                                                                                                                                                                                            SHA-256:8B8955524079508FEC59D396A891110660AE2486F24BC8BCBCDBCC975BB49AE7
                                                                                                                                                                                                                                            SHA-512:B6877F5B5B88A9B05A85F562D975A8820ACAC3773AA5FB91CEB1DA6C731C90C486A6AAF78DF6EDCF69B0EA74286DC7CC8FA2CBF98453539EFA55EC18D38116BB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...[0n...w+$.H'1,..t...).=s..Ds.......y....G2......wX+...W=............./X1AjF~G4...OD>....J.R."..S......0.Q[8....A..6.... ...

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win32\dbghelp.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1746376
                                                                                                                                                                                                                                            Entropy (8bit):6.547381278876358
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:/ETCUSw5C7fKrz3PRAarqzUH3Wj7Bnn6KB2m4JMfGPYTuLycEaU2vWUonrMLIAXg:MTj15CD0RHep6KJ4KqzEl2vWrYIA/W
                                                                                                                                                                                                                                            MD5:238C1C3286A94184FAE2C47CB7FB9DB8
                                                                                                                                                                                                                                            SHA1:EC4C96DBB342617AFCB728C4D58BDE4EDC0939DC
                                                                                                                                                                                                                                            SHA-256:74CCB6F5334248BA7020B9CDDC7D581FC6A3AC5A034489324A1FC134CF21DE6C
                                                                                                                                                                                                                                            SHA-512:0042EFB8DF5DD2D6CDE098DFD1A15217C55E8B68776856E354CED3B943C646C77A8A0132EB2A6332D76704F71A475E29F7330177CBFB4C2C4A26FFC4BA004D0E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P.}...}...}.......}....R..}...}...x.......}.......}.......}....<..}.......}.......}....>..}.......}..Rich.}..........PE..L...N.,............!.........X.......-.......................................p......3;....@A............................1...D...l....@..P................!...P..........T...............................@...............@.......`....................text...1........................... ..`.data............^..................@....idata... ......."...&..............@..@.didat...............H..............@....mrdata...... .......J..............@..@.rsrc...P....@.......d..............@..@.reloc.......P.......p..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win32\is-0OS4A.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):569856
                                                                                                                                                                                                                                            Entropy (8bit):6.48863246830026
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:09zpo7FKqmQEPmmo6G1SbhXIBQ22wnEKNy6ZfpTh2jK23L:eUANZPmjR1SbhYBT2wEKN3pmb
                                                                                                                                                                                                                                            MD5:AEF51484C41C348E6ECA26EAF36B5E00
                                                                                                                                                                                                                                            SHA1:01A37C222BC8EAFDF250953BFD5D0593CEB7AB5A
                                                                                                                                                                                                                                            SHA-256:F3E9E0DF553D9DF6650981A0758EDE142A33A889786BBEB586FE7EDC7F9E27EB
                                                                                                                                                                                                                                            SHA-512:E7B29E38F516D934617E0C46BC0DB33390E28890867427ADA0989CBB1F1DEBAAE962B3B39D0749BC5273EFF6545B967346D5F72A460D1C07B0FD451AFD58AB65
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.OT...........#................`..............a.................................p........ .................................t................................'......................................................p............................text...............................`.P`.data...............................@.`..rdata..p...........................@.`@.eh_fram8....p.......V..............@.0@.bss..................................`..edata...............`..............@.0@.idata..t............z..............@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win32\is-5JTH0.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):268760
                                                                                                                                                                                                                                            Entropy (8bit):6.271440072420579
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:mK+Zk16lasjUumChoTtckp/Ec3SYiAdCksr5CsHLz0hQTplZBXo8PrF5T681kO2y:Rbrdr3S/AdCkA57ghmlZ68rj6euk+hU
                                                                                                                                                                                                                                            MD5:B3EA90EA6E9C99965389662F8DB9DC8E
                                                                                                                                                                                                                                            SHA1:412685767347F0CB4360787214B28038B1F38278
                                                                                                                                                                                                                                            SHA-256:254609EC81013A878306C710ACFD258907E338C32EEB5FDDDB561116DFA65D40
                                                                                                                                                                                                                                            SHA-512:B963D9DFE09DB9C8E10CA91CF9504238F478F83BBA5B9B5BC4910725FBF917A1AF791E5FA8407D07E55589C8388C73CD0377405D03C88EEB5BA94A90DC5DF827
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[}..............d..1....n.......n...............n.......n.......n.......n.."....n.......n......Rich....................PE..L....m&@...........!.....r..........`...............................................I.....@A........................@}......l........0...................!...P..T,......T...............................@...............h...Xv.......................text....q.......r.................. ..`.data....L...........v..............@....idata...............z..............@..@.didat..............................@....mrdata.............................@..@.rsrc........0......................@..@.reloc..T,...P......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win32\is-AOM6Q.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1746376
                                                                                                                                                                                                                                            Entropy (8bit):6.547381278876358
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:/ETCUSw5C7fKrz3PRAarqzUH3Wj7Bnn6KB2m4JMfGPYTuLycEaU2vWUonrMLIAXg:MTj15CD0RHep6KJ4KqzEl2vWrYIA/W
                                                                                                                                                                                                                                            MD5:238C1C3286A94184FAE2C47CB7FB9DB8
                                                                                                                                                                                                                                            SHA1:EC4C96DBB342617AFCB728C4D58BDE4EDC0939DC
                                                                                                                                                                                                                                            SHA-256:74CCB6F5334248BA7020B9CDDC7D581FC6A3AC5A034489324A1FC134CF21DE6C
                                                                                                                                                                                                                                            SHA-512:0042EFB8DF5DD2D6CDE098DFD1A15217C55E8B68776856E354CED3B943C646C77A8A0132EB2A6332D76704F71A475E29F7330177CBFB4C2C4A26FFC4BA004D0E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P.}...}...}.......}....R..}...}...x.......}.......}.......}....<..}.......}.......}....>..}.......}..Rich.}..........PE..L...N.,............!.........X.......-.......................................p......3;....@A............................1...D...l....@..P................!...P..........T...............................@...............@.......`....................text...1........................... ..`.data............^..................@....idata... ......."...&..............@..@.didat...............H..............@....mrdata...... .......J..............@..@.rsrc...P....@.......d..............@..@.reloc.......P.......p..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win32\sqlite3.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):569856
                                                                                                                                                                                                                                            Entropy (8bit):6.48863246830026
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:09zpo7FKqmQEPmmo6G1SbhXIBQ22wnEKNy6ZfpTh2jK23L:eUANZPmjR1SbhYBT2wEKN3pmb
                                                                                                                                                                                                                                            MD5:AEF51484C41C348E6ECA26EAF36B5E00
                                                                                                                                                                                                                                            SHA1:01A37C222BC8EAFDF250953BFD5D0593CEB7AB5A
                                                                                                                                                                                                                                            SHA-256:F3E9E0DF553D9DF6650981A0758EDE142A33A889786BBEB586FE7EDC7F9E27EB
                                                                                                                                                                                                                                            SHA-512:E7B29E38F516D934617E0C46BC0DB33390E28890867427ADA0989CBB1F1DEBAAE962B3B39D0749BC5273EFF6545B967346D5F72A460D1C07B0FD451AFD58AB65
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.OT...........#................`..............a.................................p........ .................................t................................'......................................................p............................text...............................`.P`.data...............................@.`..rdata..p...........................@.`@.eh_fram8....p.......V..............@.0@.bss..................................`..edata...............`..............@.0@.idata..t............z..............@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win32\symsrv.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):268760
                                                                                                                                                                                                                                            Entropy (8bit):6.271440072420579
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:mK+Zk16lasjUumChoTtckp/Ec3SYiAdCksr5CsHLz0hQTplZBXo8PrF5T681kO2y:Rbrdr3S/AdCkA57ghmlZ68rj6euk+hU
                                                                                                                                                                                                                                            MD5:B3EA90EA6E9C99965389662F8DB9DC8E
                                                                                                                                                                                                                                            SHA1:412685767347F0CB4360787214B28038B1F38278
                                                                                                                                                                                                                                            SHA-256:254609EC81013A878306C710ACFD258907E338C32EEB5FDDDB561116DFA65D40
                                                                                                                                                                                                                                            SHA-512:B963D9DFE09DB9C8E10CA91CF9504238F478F83BBA5B9B5BC4910725FBF917A1AF791E5FA8407D07E55589C8388C73CD0377405D03C88EEB5BA94A90DC5DF827
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[}..............d..1....n.......n...............n.......n.......n.......n.."....n.......n......Rich....................PE..L....m&@...........!.....r..........`...............................................I.....@A........................@}......l........0...................!...P..T,......T...............................@...............h...Xv.......................text....q.......r.................. ..`.data....L...........v..............@....idata...............z..............@..@.didat..............................@....mrdata.............................@..@.rsrc........0......................@..@.reloc..T,...P......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win64\dbghelp.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2130400
                                                                                                                                                                                                                                            Entropy (8bit):6.2987957684743945
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:21CydAIdaqDwWXf6J6eFyIfbIwDLk2A/R1UTwyIuZ:21fd7dxinRDLkF/R1zuZ
                                                                                                                                                                                                                                            MD5:7A7A9CD081AB016F84249EF4F06493AD
                                                                                                                                                                                                                                            SHA1:8DC1BEBFAE34C118FE3810DC9131CBF8CCBD9EDC
                                                                                                                                                                                                                                            SHA-256:009681092F6A13C5C28BB3B08EA14BB03BA959F9CE1A53730D069550DA376C48
                                                                                                                                                                                                                                            SHA-512:D2B3F302F653741298FB62D237BFC61E1555792AAD73C14395B4DD4B97FE37F745E916B9F586945042B1EDED19C2BC0E9EFD4BE57E44610D465296BD0C544E84
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[...[...[......Y...R.W.f...[.........H......_......Z......3....9.Y...........;.Z......Z...Rich[...........PE..d....B............" .....0..........P.........................................".....1.!...`A............................................X.......l.....!.P....0 ..)...` ..!....!.pN......p............................y..8...........H.......L...`....................text............0.................. ..`.rdata..4....@.......@..............@..@.data....4..........................@....pdata...)...0 ..0..................@..@.didat..8....`!.....................@....mrdata..2...p!..@..................@..@.rsrc...P.....!....... .............@..@.reloc..pN....!..P.... .............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win64\is-0BCA6.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2130400
                                                                                                                                                                                                                                            Entropy (8bit):6.2987957684743945
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:21CydAIdaqDwWXf6J6eFyIfbIwDLk2A/R1UTwyIuZ:21fd7dxinRDLkF/R1zuZ
                                                                                                                                                                                                                                            MD5:7A7A9CD081AB016F84249EF4F06493AD
                                                                                                                                                                                                                                            SHA1:8DC1BEBFAE34C118FE3810DC9131CBF8CCBD9EDC
                                                                                                                                                                                                                                            SHA-256:009681092F6A13C5C28BB3B08EA14BB03BA959F9CE1A53730D069550DA376C48
                                                                                                                                                                                                                                            SHA-512:D2B3F302F653741298FB62D237BFC61E1555792AAD73C14395B4DD4B97FE37F745E916B9F586945042B1EDED19C2BC0E9EFD4BE57E44610D465296BD0C544E84
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[...[...[......Y...R.W.f...[.........H......_......Z......3....9.Y...........;.Z......Z...Rich[...........PE..d....B............" .....0..........P.........................................".....1.!...`A............................................X.......l.....!.P....0 ..)...` ..!....!.pN......p............................y..8...........H.......L...`....................text............0.................. ..`.rdata..4....@.......@..............@..@.data....4..........................@....pdata...)...0 ..0..................@..@.didat..8....`!.....................@....mrdata..2...p!..@..................@..@.rsrc...P.....!....... .............@..@.reloc..pN....!..P.... .............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win64\is-75A04.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):344528
                                                                                                                                                                                                                                            Entropy (8bit):5.780306640057818
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:yT/zGgy2HzkCwmkfCl00EiwtHgadXIezwnzx7I91DR9J2:y3GL2HzkCwmkfClHbghpINzZmBRa
                                                                                                                                                                                                                                            MD5:1473A9CCB67526D4010F1B0F9E6B2977
                                                                                                                                                                                                                                            SHA1:7FE8C168E976200CF1562B8E8991245226B16B9A
                                                                                                                                                                                                                                            SHA-256:F118FD9D6BA4C36DB3556D1035EFE90E99C00BF879A22ABEBE1DADFDBB3074D7
                                                                                                                                                                                                                                            SHA-512:3F459A8C9536B615BBD3B8BFEC9970F432CC72BD3287937F9F915FCBE9B2A13FCB4C45946A1722018F89DB505B418957BD513BD32A64580484D4AC7D3896A551
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........F..CF..CF..CO.1Cv..C...BB..C...BV..CF..Ce..C...BO..C...BJ..C...BG..C...B{..C..]CG..C...BG..CRichF..C........................PE..d....g............" .........................................................p.......F....`A.........................................P......tU..0....@............... ...!...`......H...p.......................(.......8....................G.......................text.............................. ..`.rdata..............................@..@.data....S...p.......p..............@....pdata........... ..................@..@.didat..............................@....mrdata..2.......@..................@..@.rsrc........@... ..................@..@.reloc.......`......................@..B................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win64\is-7TPL7.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1311232
                                                                                                                                                                                                                                            Entropy (8bit):5.897658121795144
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:aHnKY5WcmiyfogSknJbjhrbXBbrxaLsBDJbVQAjXwcasznMbDz43X6dmM:aqY5Wcmi4FJbXdsLsBNRQAjgH
                                                                                                                                                                                                                                            MD5:C11138204609EA63A3E88B4C8C09B035
                                                                                                                                                                                                                                            SHA1:B0829124F7E275B0F341C6AF0FDD3DD5F65667A4
                                                                                                                                                                                                                                            SHA-256:60C16C2FAB14B344B8343778DCD6BBFDEE3DFE5F83D1AC8D2E50C6877419EEE4
                                                                                                                                                                                                                                            SHA-512:28D9E92498433C1F6EC41893FC17DB76D6CB7A1C565461EB6E67EEBC2B924DD4AA65486C29874CAA9AC5C78F804A8799C7CE1C641DD9F080BF1BF94B58CA208C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................"........d......e.....f......e......a......b......g....Rich...........PE..d.....OT.........." ................@I.......................................p............`.........................................@...g!......(....0.......@..............P..8....+..8...........................0>..p...........8................................text............................... ..`.rdata....... ......................@..@.data....q.......D..................@....pdata.......@......................@..@.idata..X...........................@....rsrc........0......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win64\sqlite3.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1311232
                                                                                                                                                                                                                                            Entropy (8bit):5.897658121795144
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:aHnKY5WcmiyfogSknJbjhrbXBbrxaLsBDJbVQAjXwcasznMbDz43X6dmM:aqY5Wcmi4FJbXdsLsBNRQAjgH
                                                                                                                                                                                                                                            MD5:C11138204609EA63A3E88B4C8C09B035
                                                                                                                                                                                                                                            SHA1:B0829124F7E275B0F341C6AF0FDD3DD5F65667A4
                                                                                                                                                                                                                                            SHA-256:60C16C2FAB14B344B8343778DCD6BBFDEE3DFE5F83D1AC8D2E50C6877419EEE4
                                                                                                                                                                                                                                            SHA-512:28D9E92498433C1F6EC41893FC17DB76D6CB7A1C565461EB6E67EEBC2B924DD4AA65486C29874CAA9AC5C78F804A8799C7CE1C641DD9F080BF1BF94B58CA208C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................"........d......e.....f......e......a......b......g....Rich...........PE..d.....OT.........." ................@I.......................................p............`.........................................@...g!......(....0.......@..............P..8....+..8...........................0>..p...........8................................text............................... ..`.rdata....... ......................@..@.data....q.......D..................@....pdata.......@......................@..@.idata..X...........................@....rsrc........0......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\win64\symsrv.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):344528
                                                                                                                                                                                                                                            Entropy (8bit):5.780306640057818
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:yT/zGgy2HzkCwmkfCl00EiwtHgadXIezwnzx7I91DR9J2:y3GL2HzkCwmkfClHbghpINzZmBRa
                                                                                                                                                                                                                                            MD5:1473A9CCB67526D4010F1B0F9E6B2977
                                                                                                                                                                                                                                            SHA1:7FE8C168E976200CF1562B8E8991245226B16B9A
                                                                                                                                                                                                                                            SHA-256:F118FD9D6BA4C36DB3556D1035EFE90E99C00BF879A22ABEBE1DADFDBB3074D7
                                                                                                                                                                                                                                            SHA-512:3F459A8C9536B615BBD3B8BFEC9970F432CC72BD3287937F9F915FCBE9B2A13FCB4C45946A1722018F89DB505B418957BD513BD32A64580484D4AC7D3896A551
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........F..CF..CF..CO.1Cv..C...BB..C...BV..CF..Ce..C...BO..C...BJ..C...BG..C...B{..C..]CG..C...BG..CRichF..C........................PE..d....g............" .........................................................p.......F....`A.........................................P......tU..0....@............... ...!...`......H...p.......................(.......8....................G.......................text.............................. ..`.rdata..............................@..@.data....S...p.......p..............@....pdata........... ..................@..@.didat..............................@....mrdata..2.......@..................@..@.rsrc........@... ..................@..@.reloc.......`......................@..B................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\windowsrepair.exe (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):268704
                                                                                                                                                                                                                                            Entropy (8bit):5.837891086948313
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:0drkqKo/nt7PrwnoK0M6EZgugEkkoSE5O7Z3LLr:6rkm9mP6EZgugEnoSE5OB
                                                                                                                                                                                                                                            MD5:9A4D1B5154194EA0C42EFEBEB73F318F
                                                                                                                                                                                                                                            SHA1:220F8AF8B91D3C7B64140CBB5D9337D7ED277EDB
                                                                                                                                                                                                                                            SHA-256:2F3214F799B0F0A2F3955DBDC64C7E7C0E216F1A09D2C1AD5D0A99921782E363
                                                                                                                                                                                                                                            SHA-512:6EEF3254FC24079751FC8C38DDA9A8E44840E5A4DF1FF5ADF076E4BE87127075A7FEA59BA7EF9B901AAF10EB64F881FC8FB306C2625140169665DD3991E5C25B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...............................d)..`........ ....@.................................:8..........................................d........................k...................................3.......................................................text............................... ..`.data........ ......................@....rdata...g...@...h...(..............@..@.bss....d)...............................CRT................................@....idata..N...........................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\winhook-i386.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):206232
                                                                                                                                                                                                                                            Entropy (8bit):6.577803539808585
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:ZyuXZus0fJ34+UZQ5IvR2diworEdVpRmY:nXZgV4dkIJfrEdVt
                                                                                                                                                                                                                                            MD5:DE625AF5CF4822DB08035CC897F0B9F2
                                                                                                                                                                                                                                            SHA1:4440B060C1FA070EB5D61EA9AADDA11E4120D325
                                                                                                                                                                                                                                            SHA-256:3CDB85EE83EF12802EFDFC9314E863D4696BE70530B31E7958C185FC4D6A9B38
                                                                                                                                                                                                                                            SHA-512:19B22F43441E8BC72507BE850A8154321C20B7351669D15AF726145C0D34805C7DF58F9DC64A29272A4811268308E503E9840F06E51CCDCB33AFD61258339099
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........t...D)..0........ ...............................@..................................................P........................g.......#...................................................................................text............................... ..`.data...t.... ......................@....rdata..0d...@...f... ..............@..@.bss....D)...............................CRT................................@....idata..............................@....rsrc...............................@....reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):271256
                                                                                                                                                                                                                                            Entropy (8bit):6.040002515360521
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:XcxPVJy83/NkY56owwouBQGsyTfkaiX6P0a:XkPV483FB56wsyTfkOJ
                                                                                                                                                                                                                                            MD5:F9C562B838A3C0620FB6EE46B20B554C
                                                                                                                                                                                                                                            SHA1:5095F54BE57622730698B5C92C61B124DFB3B944
                                                                                                                                                                                                                                            SHA-256:E08B035D0A894D8BEA64E67B1ED0BCE27567D417EAAA133E8B231F8A939E581D
                                                                                                                                                                                                                                            SHA-512:A20BC9A442C698C264FEF82AA743D9F3873227D7D55CB908E282FA1F5DCFF6B40C5B9CA7802576EF2F5A753FD1C534E9BE69464B29AF8EFEC8B019814B875296
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....d..t....-...........................................0.................................................................P........................g......h.......................................................0............................text....d.......f.................. ..`.data...t............j..............@....rdata..............................@..@.pdata...........0...`..............@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@....reloc..h...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Program Files\Norton\Browser\NortonBrowserUninstall.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5727368
                                                                                                                                                                                                                                            Entropy (8bit):7.987929042344586
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:BiykuiGAGbjNHbd5lbDK4pdfAstezXYCvzV:BiyKGBZhKEmyezIUR
                                                                                                                                                                                                                                            MD5:F269C5140CBC0E376CC7354A801DDD16
                                                                                                                                                                                                                                            SHA1:BBCEEF9812A3E09D8952E2FE493F156E613837B2
                                                                                                                                                                                                                                            SHA-256:5AE1ACF84F0A59FA3F54284B066E90C8432071ACE514ACCB6303261D92C6A910
                                                                                                                                                                                                                                            SHA-512:BA271257C0DBFBFD63685449A5FA5EA876B31C4F1898F85AA1BE807F1E31846D12F2162F715FC320FB014D31C15501EA71FE73B3C981E201BFA1A448FF54745C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV.*_...PV..PW.MPV.*_...PV.sf..PV..VP..PV.Rich.PV.........PE..L......].................f...*.......5............@.................................$.X...@..............................................(...........;W..(...........................................................................................text...{d.......f.................. ..`.rdata...............j..............@..@.data...X............~..............@....ndata...................................rsrc....(.......*..................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\ProgramData\AVG\Icarus\Logs\icarus.log

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (608), with CRLF line terminators
                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                            Size (bytes):1400007
                                                                                                                                                                                                                                            Entropy (8bit):5.387513510610778
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:aIE5G1EspAuw36OGyUtHpbjdiPMli+4rcIjLkJfpCNXz2EE+aXRMv:hHpQPMli+4rdjLkJfpCNXzPE+aXRMv
                                                                                                                                                                                                                                            MD5:1313861C4234C80757AE5A85FCB748AD
                                                                                                                                                                                                                                            SHA1:108C07BE407967B290D125DF323DE79225AC6A95
                                                                                                                                                                                                                                            SHA-256:CE6F77B0521A7134BA252B95DF82E22B33F607575644116AC103574C3DB6B35F
                                                                                                                                                                                                                                            SHA-512:B9347EC9C7BBCCA423E7C0B2ED32E1FB752682530D1F4A7508A2241BF13AA9EFB369FCB876EAF5A4A1521ABA0B7E4CFF921229C4361857984340CF6D7A56D649
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.[2024-10-13 21:44:50.775] [info ] [entry ] [ 6504: 6500] [DF28B6: 39] Icarus has been started...[2024-10-13 21:44:50.775] [debug ] [settings_lt] [ 6504: 6500] [2C8384: 190] generic accessor for scheme registry set..[2024-10-13 21:44:50.775] [debug ] [event_rout ] [ 6504: 6500] [6A736D: 49] Registering request fallback handler for event_routing.enumerate_handlers. Description: event_routing_enumerate_handlers_handler..[2024-10-13 21:44:50.775] [debug ] [event_rout ] [ 6504: 6500] [6A736D: 49] Registering request fallback handler for event_routing.enumerate_handlers2. Description: event_routing_enumerate_handlers_handler..[2024-10-13 21:44:50.775] [debug ] [event_rout ] [ 6504: 6500] [6A736D: 49] Registering event handler for app.settings.PropertyChangedValue...[2024-10-13 21:44:50.775] [debug ] [event_rout ] [ 6504: 6500] [6A736D: 49] Registering event handler for app.settings.PropertyChanged...[2024-10-13 21:44:50.775] [debug ] [event_rout ] [ 6504: 6500] [6A736D:

                                                                                                                                                                                                                                            C:\ProgramData\AVG\Icarus\Logs\sfx.log

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1464), with CRLF line terminators
                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                            Size (bytes):13859
                                                                                                                                                                                                                                            Entropy (8bit):5.5726222497696645
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:Pkq65c7/Ms62Pb54maYlNPGsrtzrDSr9zraDbrHJrBBrtvtx4d1m42:Pkq65uMrYamaYrOsJKZGbtvi1m42
                                                                                                                                                                                                                                            MD5:B8629D0B79662C4E53CF483EEBEBADED
                                                                                                                                                                                                                                            SHA1:8DE6495A7E61F3EB4BB58A4D76AE857FC710C17E
                                                                                                                                                                                                                                            SHA-256:E4EF22C3601037930977647B37BE0E7333D97CD9C444D1D4DB2A1160638B2C9F
                                                                                                                                                                                                                                            SHA-512:222B6EBF3109183F74DC53DE06CFA699C04D8FB50B9606EDF79837689109BCD6C894BEF7F0C48C102A7ADBD363DA6FBD35109A71999B44BB40D86C16A74F487D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.[2024-10-13 21:44:24.099] [info ] [isfx ] [ 5688: 6936] [A9733A: 183] *** Starting SFX (24.9.8001.0), System(Windows 10 (10.0.19045) x64) ***..[2024-10-13 21:44:24.099] [info ] [isfx ] [ 5688: 6936] [A9733A: 184] launched by:'2160-C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe'..[2024-10-13 21:44:24.146] [debug ] [device_id ] [ 5688: 6936] [D8D250: 70] Storing the new fingerprint..[2024-10-13 21:44:24.349] [info ] [isfx ] [ 5688: 6936] [B7A7B1: 34] SFX started with command line '/silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a'..[2024-10-13 21:44:24.349] [debug ] [isfx ] [ 5688: 5956] [D8285D: 62] Sending report data: ({"record":[{"event":{"type":25,"subtype":1,"request_id":"6d092e90-9f43-41af-b4a4-23cf9eb81468","time":172886006753

                                                                                                                                                                                                                                            C:\ProgramData\AVG\Icarus\settings\temporary_proxy.ini

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):278
                                                                                                                                                                                                                                            Entropy (8bit):3.4584396735456933
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:Q9oPdKwo/e7nwY0ow+lGUlYlUlulnvm4HflKmaGHfltNv:QCFKwh7CaI/VJNKKHNX
                                                                                                                                                                                                                                            MD5:B8853A8E6228549B5D3AD97752D173D4
                                                                                                                                                                                                                                            SHA1:CD471A5D57E0946C19A694A6BE8A3959CEF30341
                                                                                                                                                                                                                                            SHA-256:8E511706C04E382E58153C274138E99A298E87E29E12548D39B7F3D3442878B9
                                                                                                                                                                                                                                            SHA-512:CF4EDD9EE238C1E621501F91A4C3338EC0CB07CA2C2DF00AA7C44D3DB7C4F3798BC4137C11C15379D0C71FAB1C5C61F19BE32BA3FC39DC242313D0947461A787
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......[.P.r.o.x.y.S.e.t.t.i.n.g.s.].....A.u.t.h.o.r.i.z.a.t.i.o.n.=.0.....A.u.t.o.m.a.t.i.c.E.n.a.b.l.e.d.=.0.....C.o.n.f.i.g.U.r.l.=.....F.a.l.l.b.a.c.k.=.1.....P.o.r.t.=.8.0.8.0.....P.r.o.x.y.N.a.m.e.=.....P.r.o.x.y.T.y.p.e.=.0.....U.s.e.r.N.a.m.e.=.....U.s.e.r.P.a.s.s.=.....

                                                                                                                                                                                                                                            C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_000B005C003C0011001B.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):211
                                                                                                                                                                                                                                            Entropy (8bit):5.11462898568576
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:rtR88ik2JM0RG0DKhSm0tR89wZVjwOrADGq:ZRNik2JTDFnRDrjhroZ
                                                                                                                                                                                                                                            MD5:DB03E2A80141CBD81FF1FE5023ED0C20
                                                                                                                                                                                                                                            SHA1:D5A78C5F11D9EB4D39EA891E78A33FAF7C4F0A4B
                                                                                                                                                                                                                                            SHA-256:9D1FDAA65DF78B0A848A82008AF0B4219DEFA6CF976823FC7F62C9B292B1BD5F
                                                                                                                                                                                                                                            SHA-512:EE3E05A26C68CA87E5D07003F4F560D6400FECEA31B0AE39D31661AA41ACA5E5F72996A9234974A42503DF75AA8399ED2354D2A479F331573E9EFB4A01988748
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[ERR][20241013 18:54:22.508][ProcessUtils.cpp@210]: Failed to get executable filename for process with id 476. Error 31..[ERR][20241013 18:54:37.385][HttpsDownloadFile.cpp@200]: Unable to open HTTP transaction..

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (32-bit).lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:28 2024, mtime=Sun Oct 13 20:44:29 2024, atime=Wed Feb 8 15:45:06 2023, length=12807608, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):969
                                                                                                                                                                                                                                            Entropy (8bit):4.546354671296726
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8mo9IBcdtNK9GtVbY1iUAN4hxd2ydfb3hZBm:8mNBcdtNR2Oexd2ydbhH
                                                                                                                                                                                                                                            MD5:A067C66E10DAF3D0269CCF494A5C0D3B
                                                                                                                                                                                                                                            SHA1:2C3F9D49F938A427119B59DFE94E02ECC8576209
                                                                                                                                                                                                                                            SHA-256:82781FC84B37ECF2DBCAB1F5A4AB4641EE3C08572F50DB2F1D7BA69FCD9B8B7C
                                                                                                                                                                                                                                            SHA-512:2BCEDBF278F7EA46286F82A9D67B16F640341B90B564EE00F57FC5A14659219D12B48B4A556059ADDE475D463C7C122E232C9FCCFB1ABC5755A2102024D30B38
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ...-.x.....9...........;...m...........................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....v.2..m..HV.. .CHEATE~2.EXE..Z......MY..MY......V.........................c.h.e.a.t.e.n.g.i.n.e.-.i.3.8.6...e.x.e.......e...............-.......d...........g..U.....C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe..E.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.h.e.a.t.e.n.g.i.n.e.-.i.3.8.6...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .9h.V.....,.......hT..CrF.f4... .9h.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit SSE4-AVX2).lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:30 2024, mtime=Sun Oct 13 20:44:31 2024, atime=Wed Feb 8 15:45:12 2023, length=16708024, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1029
                                                                                                                                                                                                                                            Entropy (8bit):4.578383247872255
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8mwhIBcdtNK9GtSCMgrEAk84h7Md5grtdfbZfZBm:8mwKBcdtNmUTa7MdgtdVfH
                                                                                                                                                                                                                                            MD5:A3A4AB2E47470F229D58D89E202C2834
                                                                                                                                                                                                                                            SHA1:B8803A6F9D31C9D7133D14557EBE604C3F3AC3B0
                                                                                                                                                                                                                                            SHA-256:62FCD117D8DA67D66C7A3ECD7305DADD0E85D4EE9895E29C1047CD31B5EE7F16
                                                                                                                                                                                                                                            SHA-512:7DA2691134CDCA0AF6EE85744638D0C4A47B85E4F5B5C6F676FB512B9AFC8A5FF8CF4C56BCF696DFC15172C7068365FD663383F8EA19D87FF9C344DC821C0BB9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ...2Vz..............\6..;...............................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.......2.....HV.. .CHEATE~4.EXE..r......MY..MY......D.........................c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4.-.S.S.E.4.-.A.V.X.2...e.x.e.......q...............-.......p...........g..U.....C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe..Q.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4.-.S.S.E.4.-.A.V.X.2...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... ./h.V.....,.......hT..CrF.f4... ./h.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H..

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit).lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:29 2024, mtime=Sun Oct 13 20:44:29 2024, atime=Wed Feb 8 15:45:10 2023, length=16718264, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):979
                                                                                                                                                                                                                                            Entropy (8bit):4.567892349339927
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8mfh7IBcdtNK9Gt7m9ZsyAT4h78d5KdfbcuZBm:8mpMBcdtN/moRU78d0douH
                                                                                                                                                                                                                                            MD5:8135FCC4B0D3E0E289EB081160FBBAFB
                                                                                                                                                                                                                                            SHA1:CB76157F38E6D1052DF59CF4D6B10B84E3146299
                                                                                                                                                                                                                                            SHA-256:C10C47866C7DC449B193BD0248612738121F40BFC3EA1CFBF771271C1B2D7B13
                                                                                                                                                                                                                                            SHA-512:82C29409209D50E12A0C2692688BAF353687CEF147F7794865E7BDB4257101DB0474CEC9B4F57BB7025EB33FF62241786EA00CF3DAEC6AD218BCD8AEB1A4A434
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ....I........2....../...;...............................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....z.2.....HV.. .CHEATE~3.EXE..^......MY..MY................................c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4...e.x.e.......g...............-.......f...........g..U.....C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe..G.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .4h.V.....,.......hT..CrF.f4... .4h.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine help.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:36 2024, mtime=Sun Oct 13 20:44:36 2024, atime=Fri Apr 21 14:00:10 2017, length=306758, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):944
                                                                                                                                                                                                                                            Entropy (8bit):4.528159503921932
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8mZfIBcdtNK9Gtgu8dA+4BdsPdfbjlZBm:8mZgBcdtNYWjdsPdPlH
                                                                                                                                                                                                                                            MD5:77863851D0BCEE9E4484DDF2EE035ABB
                                                                                                                                                                                                                                            SHA1:D5F0F5C568C1B441E7FEA936EF5F6E21BFA65E36
                                                                                                                                                                                                                                            SHA-256:2EB421D4BADB18F598FED7860A5E397BEDBD242FC95330F7E5B3180EB894E69F
                                                                                                                                                                                                                                            SHA-512:C429A469B9AD3B79BFB903E6C4317188165E20F8CC0DDB6CB7E77DC055BAE1C7DBB33D8F4407A2CD4C358992EE9934059E193B658DE1E093352EE0989A13D6BA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ....c.....H.f......9......F............................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....l.2.F....J.x .CHEATE~1.CHM..P......MY..MY................................C.h.e.a.t.E.n.g.i.n.e...c.h.m.......`...............-......._...........g..U.....C:\Program Files\Cheat Engine 7.5\CheatEngine.chm..@.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.C.h.e.a.t.E.n.g.i.n.e...c.h.m.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .Mh.V.....,.......hT..CrF.f4... .Mh.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial (64-bit).lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:37 2024, mtime=Sun Oct 13 20:44:37 2024, atime=Fri Sep 30 18:38:22 2022, length=3403192, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):964
                                                                                                                                                                                                                                            Entropy (8bit):4.614029177492229
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8mEhdIBcdtNK9GtVBKAq40pdeKdfbBXZBm:8mE0BcdtNhQdldtXH
                                                                                                                                                                                                                                            MD5:F00D59E3E280642139176F26C1FE9841
                                                                                                                                                                                                                                            SHA1:905A19049A3E23E6A414058E912E0F53C318798E
                                                                                                                                                                                                                                            SHA-256:FC64D6F2E7478B3283ACA233A1FCFA8D6CE362F217B689B67594D87113DE7D4C
                                                                                                                                                                                                                                            SHA-512:BB2511B61DA194FDCE1CB9CA3BD662770E497D480F04E20FFBC799AE9576286A7265DBDD614B08BFD14AC1E26C50C0BD7D72154632DF3A42200342BEC7CB993C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... .....v.....q.......K.3......3..........................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....t.2...3.>U. .TUTORI~1.EXE..X......MY..MY......-.........................T.u.t.o.r.i.a.l.-.x.8.6._.6.4...e.x.e.......d...............-.......c...........g..U.....C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe..D.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.T.u.t.o.r.i.a.l.-.x.8.6._.6.4...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .Gh.V.....,.......hT..CrF.f4... .Gh.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):665
                                                                                                                                                                                                                                            Entropy (8bit):2.989929398381464
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:4xtCl0Xw0Ml//A9LY/dlrtelX8SKA89NTNAm6tibdlrMAe8mAm6ebdlrMAe8w:8wl0g0kXXdpUfKfBNAsbdpMJAibdpMV
                                                                                                                                                                                                                                            MD5:9CECB30EE563CEF0187E17C153C87AD2
                                                                                                                                                                                                                                            SHA1:35A124D70C992855C8AABAFD25A99520D2CE5BE6
                                                                                                                                                                                                                                            SHA-256:BF93799CD75A79868A1B5834D55644500110270F77529512824E2F9F1F605C06
                                                                                                                                                                                                                                            SHA-512:23ECD43901FED7827AAB04B4A4C55D0FEFD2EB39DA29A32EC0D031D9F116C61ABC3199CA38D949A44F3EF6DF774F071C0B2349B57413F92704D7C6031421B52D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F........................................................}....P.O. .:i.....+00.../C:\...................h.1...........Program Files.L............................................P.r.o.g.r.a.m. .F.i.l.e.s.....r.1...........Cheat Engine 7.5..R............................................C.h.e.a.t. .E.n.g.i.n.e. .7...5... .t.2...........Tutorial-i386.exe.T............................................T.u.t.o.r.i.a.l.-.i.3.8.6...e.x.e... ...B.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.T.u.t.o.r.i.a.l.-.i.3.8.6...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.....

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:28 2024, mtime=Sun Oct 13 20:44:28 2024, atime=Fri Sep 30 18:37:02 2022, length=399264, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):949
                                                                                                                                                                                                                                            Entropy (8bit):4.512987418875059
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8me6N7IBcdtNK9Gt0K9Q3QAh4Wdidfbh3ZBm:8mWBcdtN4L5didN3H
                                                                                                                                                                                                                                            MD5:E4547EAD7605DFCB86B1E87D5AE251E8
                                                                                                                                                                                                                                            SHA1:A14964B567ED8E855ADFFC41E95C6CB9A19DC454
                                                                                                                                                                                                                                            SHA-256:8E62B8D3EED573A908ADFA47098B7263026927A14E1B86426C9F945308AE9DCF
                                                                                                                                                                                                                                            SHA-512:0CAC07DCBC461C4D7189FF8B895636FCC9BCF09672F3FB50E6DD04C9090505343AC5A74C5AE20096073D4FD68B19B626A9DC64A070E87AB6DDDF8E1DD7BF08B0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ....No.....:.q......CV..................................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....n.2.....>U.. .CHEATE~1.EXE..R......MY..MY................................C.h.e.a.t. .E.n.g.i.n.e...e.x.e.......a...............-.......`...........g..U.....C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe..A.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.C.h.e.a.t. .E.n.g.i.n.e...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .'h.V.....,.......hT..CrF.f4... .'h.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Kernel stuff\Unload kernel module.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:35 2024, mtime=Sun Oct 13 20:44:35 2024, atime=Wed Jan 25 17:19:40 2023, length=242616, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):995
                                                                                                                                                                                                                                            Entropy (8bit):4.53121505863425
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8mw9IBcdtNK9GtEDShAp4/pdZCdfbGCMCZBm:8m1BcdtNlyCpdZCdXtH
                                                                                                                                                                                                                                            MD5:C4D17FD5CA481C39D2AE6B96546B03BB
                                                                                                                                                                                                                                            SHA1:372402AF006AC3EEFAC8B5B902D54E77117229D9
                                                                                                                                                                                                                                            SHA-256:69032AB17F0A85F20579AE97D225124428E67E8FF87EA144D02ABDE319BBDFE9
                                                                                                                                                                                                                                            SHA-512:6BF0C4A2BB57619AB743B675FF012B3CBC5E6401020671590BE22F8810DACE324C0282D6303530070D172E5A5C6FAE9EA2A47F1B8BB8CDF34D814C29F3460016
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... .....f.......p.........0...............................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....~.2.....9Vt. .KERNEL~1.EXE..b......MY..MY......B.........................K.e.r.n.e.l.m.o.d.u.l.e.u.n.l.o.a.d.e.r...e.x.e.......i...............-.......h...........g..U.....C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe..L.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.K.e.r.n.e.l.m.o.d.u.l.e.u.n.l.o.a.d.e.r...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .Uh.V.....,.......hT..CrF.f4... .Uh.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Lua documentation.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):822
                                                                                                                                                                                                                                            Entropy (8bit):3.3448018622036306
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:8Ql0M0m/3BVSXz5dlsW+fy9+B0bdpM6iNL4t2YZ/elFlSJm:8AJ/Bql+fW+GdK5qy
                                                                                                                                                                                                                                            MD5:955441A2DA3A690124D98A3F96EFEF74
                                                                                                                                                                                                                                            SHA1:42AAD5D8DDF5FF16B54C29F691D632E050548739
                                                                                                                                                                                                                                            SHA-256:D1925F7BDD234B7885A3CC2FD0E48CB714F2C25125C4536C2D9A359E4F38CCB3
                                                                                                                                                                                                                                            SHA-512:B117B636E24F432AA95758781DC0AD392AB4F744494A0D9D96955495FB690390EF4228CAC943C9E33C4B71E2B62D98CFFD78DB8E020B838D5A7E3471A1C0B12E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F........................................................A....P.O. .:i.....+00.../C:\...................V.1...........Windows.@............................................W.i.n.d.o.w.s.....Z.1...........system32..B............................................s.y.s.t.e.m.3.2.....b.2...........notepad.exe.H............................................n.o.t.e.p.a.d...e.x.e.............\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.n.o.t.e.p.a.d...e.x.e...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.+.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.e.l.u.a...t.x.t.........%...............wN....]N.D...Q..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Reset settings.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:35 2024, mtime=Sun Oct 13 20:44:35 2024, atime=Fri Feb 3 03:35:32 2023, length=309664, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):939
                                                                                                                                                                                                                                            Entropy (8bit):4.522503164871517
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8m0wb3KWIBcdtNK9GtXkYyAL4b6dEdfbISZBm:8m0wb3uBcdtNXndEd8SH
                                                                                                                                                                                                                                            MD5:A1FD9066B3CF0E36281AB05A492A4999
                                                                                                                                                                                                                                            SHA1:88AB01F90F066509643A7FCA408883E0E2B42412
                                                                                                                                                                                                                                            SHA-256:086D59CB3524261CED57716877E2C9BEC7D6418632DBD6A4B6AB891EB2EA0032
                                                                                                                                                                                                                                            SHA-512:780FDDB6B5C2AADD1D990A7F37CB3F07C97757D15629A04CBF03CAF9836384FD952BF00D500AC990DA4497BEEB0D570F54791D00AF28B6F38F01E91C17268B6D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ....4b......4b.......;.7...............................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....j.2.....CVp$ .CEREGR~1.EXE..N......MY..MY......*.........................c.e.r.e.g.r.e.s.e.t...e.x.e......._...............-.......^...........g..U.....C:\Program Files\Cheat Engine 7.5\ceregreset.exe..?.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.e.r.e.g.r.e.s.e.t...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .Xh.V.....,.......hT..CrF.f4... .Xh.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Uninstall Cheat Engine.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:28 2024, mtime=Sun Oct 13 20:44:28 2024, atime=Sun Oct 13 20:44:25 2024, length=3223968, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):929
                                                                                                                                                                                                                                            Entropy (8bit):4.549062259315716
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8mcHvIBcdtNK9GtWt/oUAF4edjEdfb20ZBm:8mHBcdtNAojZdjEdq0H
                                                                                                                                                                                                                                            MD5:7D53286CA2F61E4BE16CA360D306AC6E
                                                                                                                                                                                                                                            SHA1:C1C34FE9ACF517E21A360CA6D3335AFDA9CA7C49
                                                                                                                                                                                                                                            SHA-256:8E842616FB40973C7E585922EC44D9E701DB1889EF7EA49660462ADC36D61DAD
                                                                                                                                                                                                                                            SHA-512:95E1FDC43E64D593A23CDEB80054FC04E3E93E0352973C3C701D6C9B98E28760F11170105610BE74B9FE2A417CCDC3EBFE3CFEC82999FE9C4C95082D883F6DF5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ...=z...............@Y......11..........................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....f.2..11.MY.. .unins000.exe..J......MY..MY...............................u.n.i.n.s.0.0.0...e.x.e.......]...............-.......\...........g..U.....C:\Program Files\Cheat Engine 7.5\unins000.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.u.n.i.n.s.0.0.0...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .bh.V.....,.......hT..CrF.f4... .bh.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_98ce5e1d179be1a95e565a671c2f4cd1eea020_765d17c0_fc8ac6de-0ea4-410b-ab36-4a351c6c86c9\Report.wer

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):65536
                                                                                                                                                                                                                                            Entropy (8bit):1.412093184167142
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:PSYytEBn06D8bFctjqBgirXRaIHdzuiFeZ24IO8YT:itEB06D8bFctj2XRb9zuiFeY4IO8YT
                                                                                                                                                                                                                                            MD5:61432042366106A9342178CCEDC3DD89
                                                                                                                                                                                                                                            SHA1:F360361D294DDB1410AA48CA74FEBAE2E1EE6773
                                                                                                                                                                                                                                            SHA-256:69476E68FE3810257DB7F8A6B41A71D41EE87D010D903FB5F0BE9845023C3521
                                                                                                                                                                                                                                            SHA-512:9744DB113ECF398C3BEDAB5AA6E49066EEEDABFD930EF4E6BF372F537008457DE4FD536224861D9BBB4B94D80523008EB878DA249EAEB3F3D516FAE42E75D22A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.3.2.9.4.8.8.8.2.0.7.9.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.3.2.9.4.9.0.2.7.3.9.2.3.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.8.a.c.6.d.e.-.0.e.a.4.-.4.1.0.b.-.a.b.3.6.-.4.a.3.5.1.c.6.c.8.6.c.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.a.5.1.7.7.0.-.8.b.c.9.-.4.f.f.c.-.8.d.0.6.-.e.a.f.d.3.0.5.e.0.4.f.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...T.r.o.j.a.n...A.g.e.n.t...1.M.W.N.V.4...3.1.0.4.4...3.0.7.2.7...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.9.4.-.0.0.0.1.-.0.0.1.4.-.9.8.3.3.-.c.c.f.8.b.8.1.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WER983F.tmp.csv

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):83706
                                                                                                                                                                                                                                            Entropy (8bit):3.03133703592831
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:ClVVZ1ZcM2dF/oGsbkQ0I3N+Em6juMGjtDI:ClVVZ1ZcM2dF/oGsbkQ0I9+Em6juMGjC
                                                                                                                                                                                                                                            MD5:634336D09A19B5AAE846E18F76D1B990
                                                                                                                                                                                                                                            SHA1:8595DF53CD4DBC4F4CA8B99D13B174E75CF490FA
                                                                                                                                                                                                                                            SHA-256:D48E4D153865267528A8951826ED72C0E9B0D5928AF3945203BFF3A1FA1165CB
                                                                                                                                                                                                                                            SHA-512:3AF8E9C6CA71B8516B7F472C1ACE8A9ADA665AD2973871F06BB9215A32A12F553B36F4371A73B5D20319EDFAD07D946A66F098A51AF28EF612FF720242E8C3EA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A83.tmp.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13340
                                                                                                                                                                                                                                            Entropy (8bit):2.6972123031580515
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:TiZYWUgffE4YoYIWIzdH8UYEZQQYtDimEosuwyFQNuzoadtHpMhp9IQVg:2ZDUevoxGad9pMhpCQVg
                                                                                                                                                                                                                                            MD5:DB1A944E0828F7E99C0A0D18DF07CCD6
                                                                                                                                                                                                                                            SHA1:1BE52495B5DC80DB3C86BEF389EF491E34D68902
                                                                                                                                                                                                                                            SHA-256:8592F92878786ED729D636B8E787BC4E06FD33001CD59F24E12A8C17DDB39089
                                                                                                                                                                                                                                            SHA-512:58DCBCA854F0EBB5DAA5E4524BD9603BD5AA604A0D6F9EF0308E151C290C9BB47B8B633EF077C46C1E892E62B7ECCE63582ADF3A05E0BA9F68F7C235F6F3B296
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA3D.tmp.dmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            File Type:Mini DuMP crash report, 15 streams, Sun Oct 13 21:44:49 2024, 0x1205a4 type
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):136688
                                                                                                                                                                                                                                            Entropy (8bit):2.178234858138619
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:mitvJqDeb9WsJ7xhP/PypaPEEJG+orrWj:mSxZJNhapaPEEJG+ofm
                                                                                                                                                                                                                                            MD5:12FAA9B4E476D651AC3DACFBF463FEAE
                                                                                                                                                                                                                                            SHA1:AD73F336FE866AA0A70EB0A9C59D049CBAB48397
                                                                                                                                                                                                                                            SHA-256:5549DEAE539FF04387B0FB315FB1F4EAC9680127CAB551A2F843D803326C5A5E
                                                                                                                                                                                                                                            SHA-512:2EE1CC24D35E374F23A03098BF16E7971C9DDA296221CCC5DFA6F255C23AFC96B77CEE23ECF758FD4B54713E0455B710847B066B7667CA40454D2A950F6FDB4D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MDMP..a..... .......Q?.g............D...........(-..X............6......D....n..........`.......8...........T............k.............$8...........:..............................................................................eJ.......:......GenuineIntel............T............?.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE64.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8680
                                                                                                                                                                                                                                            Entropy (8bit):3.7097444068586247
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:R6l7wVeJ8I69oZ6Ygv64H/vgmfN8epr789bzdsfoRm:R6lXJ769oZ6Yw6e3gmfN8XzWfj
                                                                                                                                                                                                                                            MD5:4E9548FED69F4FA2EBB0699652D46DF1
                                                                                                                                                                                                                                            SHA1:6016447AD2D3F449EF65D1FAC84010F4DDAF9471
                                                                                                                                                                                                                                            SHA-256:870360A4844CD7DEF33329075A7C8E73DF2FE54BD5F12779CF9285BD938AD0D0
                                                                                                                                                                                                                                            SHA-512:5BD806F332FEC5608AEC88632D6F8CE0371A488815E6962E696487148B89CFF0B5865CA2472AF30C8026DC3F3C793182F1928629A9D169E9A0970F33AB6B75F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.9.2.<./.P.i.

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERDEB3.tmp.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5009
                                                                                                                                                                                                                                            Entropy (8bit):4.574266544014679
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:cvIwWl8zsCJg77aI9vUWpW8VY6Ym8M4JSXNkXjFVW+q8RXmXLg1FRjWv4Fd:uIjfQI7lN7ViJSXOXrWCXmXOF1Wv4Fd
                                                                                                                                                                                                                                            MD5:0F1C8B94299B2DC77D4DF59AB29369B7
                                                                                                                                                                                                                                            SHA1:124BF8D21B85783EB2A458AB7E2E4CA6CDCC88A4
                                                                                                                                                                                                                                            SHA-256:61DA83051A890FA8F02F78871A643AFE3B59797E34DF7C703351E8BF7EBEC2EF
                                                                                                                                                                                                                                            SHA-512:F42C54AD06C5ACC2B058686C7C5EC88A8CB2229953709915FA58C8EBF8C4562B30C4FA90EBAF41032C7CB3EE89F20AC11E39EFD6D4C77F92CCDE1CB2478F97EE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="542207" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERDED1.tmp.csv

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):83288
                                                                                                                                                                                                                                            Entropy (8bit):3.0328271592469203
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:NRWpZKxxG9WAdgHOx/SZQ6N+Em6juMLfs:NRWpZKxxG9WAdgHOx/SZQO+Em6juMLfs
                                                                                                                                                                                                                                            MD5:F3728623517E30B28A5AC3440DDF862C
                                                                                                                                                                                                                                            SHA1:A4E07524E76C07F1D0FC9D67BE283564E286202D
                                                                                                                                                                                                                                            SHA-256:9C3E47B237AF74F3D47BD16E53B09731A730D09EE8A421CEECD7384E1BCA99EE
                                                                                                                                                                                                                                            SHA-512:43D87DCE70341B00AA7C9E2FA3A02F3C16FF7458024CAD9F2C12A775F119FAB6FBB7EE8FA59903BF5EA18C912EBDF353ACD87D17EBB41C192C49B3C6F7B7663A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF8D.tmp.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13340
                                                                                                                                                                                                                                            Entropy (8bit):2.688529804726502
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:TiZYWi71qgZwYDYbkWsZHKUYEZ0otAiS3ZqzwYB6FaW4s1MsveITRy3:2ZDiPw042oFaW4s1MsvpTE3
                                                                                                                                                                                                                                            MD5:26A643E77B8766C9BFD21F2A781E1994
                                                                                                                                                                                                                                            SHA1:4B6EBD619ACF2FDB63A50B608DC0BFAEAD4A0F54
                                                                                                                                                                                                                                            SHA-256:0A31566FBE9F0D687317056D88955890BC7A49FE261D81C555D1E6F5F02D3A1D
                                                                                                                                                                                                                                            SHA-512:6571BD1A0E41D4C347EDA598462486EBD1DAFB61027DCB92D41B86F2C5907BDD30FAA5F44724A6F3C7992C5F680DED87FCEC6ADCD834DF013FA8A614E8EF81C9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                            File Type:Certificate, Version=3
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1398
                                                                                                                                                                                                                                            Entropy (8bit):7.676048742462893
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:ujsZPSIPSUcnA3/46giyfV4Hxk7P3Gus6acCQ4CXmW5mOgs:ujul2nQ4XfVkk7P3g6dB42mVs
                                                                                                                                                                                                                                            MD5:E94FB54871208C00DF70F708AC47085B
                                                                                                                                                                                                                                            SHA1:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
                                                                                                                                                                                                                                            SHA-256:7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
                                                                                                                                                                                                                                            SHA-512:2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:0..r0..Z.......vS..uFH....JH:N.0...*.H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0...*.H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

                                                                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:Certificate, Version=3
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1428
                                                                                                                                                                                                                                            Entropy (8bit):7.688784034406474
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
                                                                                                                                                                                                                                            MD5:78F2FCAA601F2FB4EBC937BA532E7549
                                                                                                                                                                                                                                            SHA1:DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
                                                                                                                                                                                                                                            SHA-256:552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
                                                                                                                                                                                                                                            SHA-512:BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:0...0..x..........W..!2.9...wu\0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0...*.H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...s*n..|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0...*.H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

                                                                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):264
                                                                                                                                                                                                                                            Entropy (8bit):3.10545065785345
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:kKXsWFkYGhipWhliK8al0GQcmqe3KQjMIXIXL/:fsYkYGIWzyZ3qe3KQjxXIT
                                                                                                                                                                                                                                            MD5:BD0012EA6659BE0DA1BFC298A13BD7C4
                                                                                                                                                                                                                                            SHA1:3B3A523198959F39AE16AF26B492859B7C960ECE
                                                                                                                                                                                                                                            SHA-256:D91D7E7C589485CEE7B2F0D872750021D9B0340F7D4A71B41F9AC7EC9E149908
                                                                                                                                                                                                                                            SHA-512:6ECDC731607E67975A3118EBEC4BA2DA29E28D12BD90006515920329BA5BD5E87DC091750DD0F10BCBCE81E0F751B3BE64A406815AC4FBE0F104DF180E21A10F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:p...... ....v....M.$....(....................................................... ...............(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.4.8.4.5.-.5.7.6."...

                                                                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):254
                                                                                                                                                                                                                                            Entropy (8bit):3.049926868931215
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:kKKhLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:yhLYS4tWOxSW0PAMsZp
                                                                                                                                                                                                                                            MD5:A4B84AE3DECD7524E243CAEF4E86B129
                                                                                                                                                                                                                                            SHA1:5F9B06A82C2D96EDA51CA2A6FE18C797488FD883
                                                                                                                                                                                                                                            SHA-256:27E67D93FD69EAAC0EAF7C27176D44D4D7A9EBAE599245343642B299BFFDBF8D
                                                                                                                                                                                                                                            SHA-512:96BB36372CC677CB79FDE7839904D33BB2EEB779E6A1CBDBC781A4903BF327EE8818DB7A3E5AC379BD3048E671D2BB868674A2972B4F74E661CBE50B0E1E567E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:p...... ....l......g....(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\6358C710-B89F-46B9-93F2-F6CAC44F5286

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1128
                                                                                                                                                                                                                                            Entropy (8bit):3.8684865936959536
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:V98uCSRwOBZD0sHTAmmvnAEb0lo1VrAelss4PwZla1S0ILdlQKoPXPC9f0+Tmn:V98uhikD0WUphb0lAVtlsxPqa1SIKo/D
                                                                                                                                                                                                                                            MD5:362063EB55B71F91EB0137D597FC50EA
                                                                                                                                                                                                                                            SHA1:0E884567AC0683420E2195332246DB6E3D727524
                                                                                                                                                                                                                                            SHA-256:60C3437BD5A55914D775A8A6D28D727C9FBED95C4FD82D2A43696DD1955AC5CF
                                                                                                                                                                                                                                            SHA-512:A2EE2051073F90E7E166FB74FE210956A2529518A832C6E1A76C4B457131E979713C012CA914E828ECEB18D355EC5F7D4F69A378E69B25046F47638869026CB8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.A.i.T.4.J.8.O.V.k.m.x.Q.+.s.x.1.G.5.4.Y.A.Q.A.A.A.A.C.A.A.A.A.A.A.A.Q.Z.g.A.A.A.A.E.A.A.C.A.A.A.A.A.y.L.A.y.u.D.4.0.K.h.p.c.L.2.x.v.P.8.R.z.B.s.v.5.V.T.3.W.h.I.e.4.F.o.g.z.E.4.C.Q.U.c.Q.A.A.A.A.A.O.g.A.A.A.A.A.I.A.A.C.A.A.A.A.B.M.2.h.E.Q.Y.e.C.8.Z.1.X.c.P.K.a.v.a.i.i.0.6.h.F.9.F./.e.5.b.Z.8.g.q.l.t.e.+.M.s.U.X.N.A.A.A.A.B.H.0.0.G.F.p.p.6.T.u.e.w.1.o.K.4.5.+.g.8.a.B.e./.H.a.O.9.B.I.4.u.U.c.X.d.Y.T.2.o.F.X./.f.K.D.c.c.N.l.4.W.6.O.G.g.V.a.h.B.A./.Q.w.P.W.d.R.Z.z.Y.H.i.W.6.1.a.I.t.p.5.p.6.L.L.b.c.8.H.4.C.M.q.D.q.M.P.N.a.R.S.c.c.j.K.6.5.0.V.L.3.S.J.9.t.0.C.b.T.q.+.n.2.7.1.m.d.d.4.+.q.T.w.7.1.q.T.R.+.F.d.N.e.A.O.0.C.b.n.j.A.c.F.N.R.6.H.t.K.v.L.i.c.V.J.3.P.Y.Y.f.Q.T.R.O.T.c.c.r.2.Y.1.R.P.0.J.K.d.v.w.v.S.o.h.h.U./.j.y.O.R.5.a.n.G.g.m.6.m.m.1.D.I.p.R.z.+.D.x.K.9.I.o.C.z.m.s.3.4.K.S.r.b.j.o.X.R.l.c.x.2.P.o.F.V.a.F.9.2.O.3.m./.F.L.8.Q.P.K.P.v.B.1.s.6.u.d.Y.u.S.k.V.t.K.n.v.X.g.Q.A.A.A.A.I.1.F.5.f.4.4.6.s.Z.C.f.B.Z.V.t.o.5.N.A.h.K.A.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Cheat Engine Symbols\structures.sqlite

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3008008, page size 1024, file counter 1, database pages 10, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):1.6211119274023298
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:ri4sWLMSpHJCSHBv52qolhdQZSRmAH/0UkEvWTtSDGsWLMSpHJCSHBv52qolhdQU:3s6pHj55XQp8UkEESSs6pHj55XQZ
                                                                                                                                                                                                                                            MD5:551F7A35DEC7A2436EFA7181DF0F5DB4
                                                                                                                                                                                                                                            SHA1:38EEA293AB5906FEAD7DF8351863FD75171F864E
                                                                                                                                                                                                                                            SHA-256:9F5C71448B5A562560E138BA873E4D827DA45C83745E570FD40DF43D4BEC56D6
                                                                                                                                                                                                                                            SHA-512:CE47D79874F71FED3B9930717A8BD2B827DCD6F8CD1D1DE7E1B913D69C9DFC050B6314538A0AEF88A3F89ADC78CE1E5C55A8661395E1AF373DE34C296093271F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .........................................................................-....................._....................................................................................................................................................................................../...C...indexsqlite_autoindex_elements_1elements.[...!!...indexnamelookupstructures.CREATE INDEX namelookup on structures(moduleid, tablename).F...!!..Wtablestructuresstructures.CREATE TABLE structures(moduleid INTEGER NOT NULL, typeid INTEGER NOT NULL, tablename varchar(255) NOT NULL, length INTEGER NOT NULL, PRIMARY KEY (moduleid, typeid))3...G!..indexsqlite_autoindex_structures_1structures.P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).>.......Stablemodulesmodules.CREATE TABLE modules(moduleid INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, modulename varchar(255) NOT NULL, timestamp int NOT NULL, UNIQUE (modulename, timestamp))-...A...indexsqlite_autoind

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Cheat Engine Symbols\structures.sqlite-journal

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
                                                                                                                                                                                                                                            File Type:SQLite Rollback Journal
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):512
                                                                                                                                                                                                                                            Entropy (8bit):0.28499812076190567
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:7FEG2l/2nPlt//lxll:7+/l/AP
                                                                                                                                                                                                                                            MD5:3A3CB1E8F2D226DFC86DD33A287A5009
                                                                                                                                                                                                                                            SHA1:6B6E0058EF3A3C6762412D72704DCE99B8598DE2
                                                                                                                                                                                                                                            SHA-256:22A60AF7442CF06EC9965D9510DF812A5164915499781A9531C41D728FCE9B26
                                                                                                                                                                                                                                            SHA-512:9F1FC129C14328782AE75845EF009C0F0251A262AA3DC845F08E1FFC066236C00B27290F2C893993949F9D2181B900133D6E8ED6BB193E244E62F3B6608DCEA8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.... .c.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Cheat Engine\{6A903629-B36E-4F78-A3A6-28363430D0D6}\ADDRESSES.TMP.FILETEST

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30
                                                                                                                                                                                                                                            Entropy (8bit):3.8280729963885096
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:XlhDM8FGQEmB:vDHUmB
                                                                                                                                                                                                                                            MD5:826273A91309B13197041791BA18034C
                                                                                                                                                                                                                                            SHA1:C1D7C61766E2CC7C8F4FC156C0F002017EB73721
                                                                                                                                                                                                                                            SHA-256:4876AAF849BBFBE676C85E6F9A2D842C5EC7D2BC6078302956101030F155A7EE
                                                                                                                                                                                                                                            SHA-512:835A3F71D485E690A13945F3D5EB71FB507B07EB18E0288548569C953AB2EB59211696FFA87CE8A7481DF929B3277DEA1FBD0495FE771994B1D2F3E4869FB9DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:....This file can be recreated

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64
                                                                                                                                                                                                                                            Entropy (8bit):2.728373781480404
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:LlTHJhBROgX3nlITlROJ3mln:RFkwncI5mln
                                                                                                                                                                                                                                            MD5:C9E09139408CE8BCCA446BD8AAD7623F
                                                                                                                                                                                                                                            SHA1:CB8A1B7AD0394BA4D0D86D5A6D0D88A55AA1E949
                                                                                                                                                                                                                                            SHA-256:6B450C78E833E61E14955F7EBCBB90A88CBC01FB021B931BAF21B5F488954E26
                                                                                                                                                                                                                                            SHA-512:5E2B2CBF3550BFAFFF2CABFC6D89BB52549AC3D95139E0451F2B3191993C7D001EC4A1071B0615EDABF961B3FDE1DB1B9B126157B5F20EC2E814930E128F9FC7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:3.F.E.F.6.B.C.8.1.4.D.E.2.5.B.8.D.4.E.E.2.2.C.1.E.8.6.4.1.6.2.C.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):72
                                                                                                                                                                                                                                            Entropy (8bit):2.718207334657729
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:zlIRlQd6bSLljPlaUlIliQIPYs:zyf+RjPFSkdws
                                                                                                                                                                                                                                            MD5:4A9450D1EEF004026940217E568C0973
                                                                                                                                                                                                                                            SHA1:4A6E9250F14273F19956FF4609F7115008F0DC2A
                                                                                                                                                                                                                                            SHA-256:858A3B2373FAB66DB297CCCE18549EB86A476E512DCA447745C96E8B680728DE
                                                                                                                                                                                                                                            SHA-512:DB7D2FC18AFCF6D01D753ABD2F5D21B64AB5F16221A7CD5B91A45FE834D815056FB47B2703C552559F152A8D99E96BAF085A488626F4A67A709476CA6B60044C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:e.3.2.7.4.1.d.b.-.f.7.1.d.-.4.5.3.d.-.a.3.8.1.-.3.1.d.d.8.4.7.d.f.7.e.d.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3025312
                                                                                                                                                                                                                                            Entropy (8bit):6.402393103402349
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:5LJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvu1:vwSi0b67zeCzt0+yO3kSU
                                                                                                                                                                                                                                            MD5:2C94C19646786C4EE5283B02FD8CE5A5
                                                                                                                                                                                                                                            SHA1:BF3DD30300126BA9B51C343D64DA2D8EDA23EBEA
                                                                                                                                                                                                                                            SHA-256:9BE09875AA698A85C446FB80E075087D6C0A543A493A7F033F3015FE2F0680D5
                                                                                                                                                                                                                                            SHA-512:7C3D5E740340042E34F25047A29ADD080E89027DB2D49775AAD529ECB8E13BFB83F73ADB3B2999E129A27D85C9B0021E3BF3E110AC93CDF6C6393D121A0F7D4E
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.................................../...@......@....................-......`-.49....-...............-..+....................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3223968
                                                                                                                                                                                                                                            Entropy (8bit):6.338087367720092
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TYfx:0HDYsqiPRhINnq95FoHVBT333T+
                                                                                                                                                                                                                                            MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
                                                                                                                                                                                                                                            SHA1:9752F38CC51314BFD6D9ACB9FB773E90F8EA0E15
                                                                                                                                                                                                                                            SHA-256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
                                                                                                                                                                                                                                            SHA-512:B0A00082C1E37EFBFC2058887DB60DABF6E9606713045F53DB450F16EBAE0296ABFD73A025FFA6A8F2DCB730C69DD407F7889037182CE46C68367F54F4B1DC8D
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1......u1...@......@....................-.......-..9....................0..k....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6144
                                                                                                                                                                                                                                            Entropy (8bit):4.720366600008286
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                                                                                                                            MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                                            SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                                                            SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                                                            SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\AVG_AV.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):53151
                                                                                                                                                                                                                                            Entropy (8bit):7.982330941208071
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:GcHlp3vMusTtWEgKqx8zHom+GChNPDViFKWUyG:Ggz3kTNgKq66VcFKW9G
                                                                                                                                                                                                                                            MD5:AEE8E80B35DCB3CF2A5733BA99231560
                                                                                                                                                                                                                                            SHA1:7BCF9FEB3094B7D79D080597B56A18DA5144CA7B
                                                                                                                                                                                                                                            SHA-256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
                                                                                                                                                                                                                                            SHA-512:DCD84221571BF809107F7AEAF94BAB2F494EA0431B9DADB97FEED63074322D1CF0446DBD52429A70186D3ECD631FB409102AFCF7E11713E9C1041CAACDB8B976
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a....4IDATx.......y...u.}...W."..(s ........p.........Q...?ql=...'.8....E.l...Y.-ah..FP.w.......__uUwuw.r.3X.z..........jcppph........O.appp..........n ..qph..88.......pd...y...!..888.##...._..C.8....Cn82...,.8...40....!7..qph..GF.2.........C.h....q#.........!7..qph.O..../_..p......B....K...`.XF.n}........S/b.._..?.XH.2q...i.}..y....c...8..b|~:WY...8....a......o...v..!.~.+8z...P.....y......2y^....!.w..C.=..'.J]..v. ..}./o..q....M...........<$.X.<)..g.gp......'.Y.I...'.x......D.(..C...m.. .:.#....$. .LdD.E...*..a..}..eih.A.....AyR...7a..2..N##DD^....Tg...;>$..tZo.....m......3.A..p....$MM.".hF.......qpX....7..F.=.k..e".G/...G~E.........4..kA.{....yN.dH)~.s...........#.W...lD.:..W}...#...kP.&...;....n......?..d....oH.....#..'a..s..D.....<.......h...y.....D..!.^...G....4.........c .;?$..6...@.....O c.......~.u...1.7......c.|..'...?/..#;.z&....T.M4.w.."....7W....

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\AVG_BRW.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47501
                                                                                                                                                                                                                                            Entropy (8bit):7.9807583617034075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:ymnQh4I8TZIyg23yWlcrF+Dx3hmI7IFrVVzEUxeeizfxEO7Ncc1qB:ymnQCHRg23yQWFyx57IFRVrseizfGEOx
                                                                                                                                                                                                                                            MD5:1CD4A2B4A992ACC9235D9FACD510E236
                                                                                                                                                                                                                                            SHA1:A6F6331879CC8CF0A6F091CC3C66EA95D1425A57
                                                                                                                                                                                                                                            SHA-256:57F2E86B2C8D9C695073CBAED29C674EF748734460A33ED04AC6888B69288B1F
                                                                                                                                                                                                                                            SHA-512:AE2C4AE9E3B46C252D6BB5A9654AB25431D7239D10EF78889452E9292A8B46283AF4319749A7233D08D836B8799CF7A5C0E5AA715A4D7836E4B83167B20F6595
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a...."IDATx.......u&.....h..;.P(P.!..Q.b-hH..e..H.=...+y<.fc..l....7.....w.y......,z>..[..%...-J2..)...4H......^....q.NEe.......%23.....9'".<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<f..Rd....z..^.UH.Xf.=W-')M....g...=<<<<<..hA....'...^.-.....u...MWo9n:..%....mR...*...}.hLf...xxxxx.;@P.J...B.t[*.w..6.4:L.[..n~]~R..:.4n....62......1O &.J.T...;w....>s.{7]...<I..N.I...>)_.P...E.u.......!.4q.g]g...J..........(.f...0!..>)..W.:L..p}.t...TfR...%.R..>;yK.U.v...,#<...2...|....\. ..;..C.......1...(_...z.C|.....1...f.;.}......Cx<....qW8tC.r.G.\.... n......<<<<<..J...;.....|.;.... ^.X.9\......^......[NI.:,....:.SvF.Y.h...u......#GC......4!.n......P0q.k.A.(.n..i}td.PX......8.$!a...qEI................O......A.O(...@<.iL ....$.Y.f....U.p.c.:.....@...T..4.."n.M.....G:..o(mB.SO=%e..H....&...0\K.x|.p.....:.<ukHf.L..HDD.a..m....I.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):27406384
                                                                                                                                                                                                                                            Entropy (8bit):7.993410954401878
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:786432:37YPcmlabhBx9CrdUxTvngF7oUNUQWQu7pquEKLR:rGTabv+CVYhoLXQ8BR
                                                                                                                                                                                                                                            MD5:E0F666FE4FF537FB8587CCD215E41E5F
                                                                                                                                                                                                                                            SHA1:D283F9B56C1E36B70A74772F7CA927708D1BE76F
                                                                                                                                                                                                                                            SHA-256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
                                                                                                                                                                                                                                            SHA-512:7F6CABD79CA7CDACC20BE8F3324BA1FDAAFF57CB9933693253E595BFC5AF2CB7510AA00522A466666993DA26DDC7DF4096850A310D7CFF44B2807DE4E1179D1A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................R...^.......^.......p....@.................................".....@......@...................@....... .......p..................k...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\WebAdvisor.png (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):48743
                                                                                                                                                                                                                                            Entropy (8bit):7.952703392311964
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
                                                                                                                                                                                                                                            MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
                                                                                                                                                                                                                                            SHA1:0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
                                                                                                                                                                                                                                            SHA-256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
                                                                                                                                                                                                                                            SHA-512:9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..|.....{l\tO.|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.|.......?..#......2vO....F......@.|..w7].|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`|..?.....?...{..~~........).........`$.......tG....|.n.2..........[..._....e.}.=..<........h.7|?Kg....+

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6144
                                                                                                                                                                                                                                            Entropy (8bit):4.720366600008286
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                                                                                                                            MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                                            SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                                                            SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                                                            SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\error.png

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):255196
                                                                                                                                                                                                                                            Entropy (8bit):7.96973939556344
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:SpgUGHaX5IfwHkEe6PgHV90nLp8M8yv0zXqtveJsGfr5:SpghMe6IDop8Mjv0Yv+sGD5
                                                                                                                                                                                                                                            MD5:2C5238DA8AAF78FB2722F82435B59EB0
                                                                                                                                                                                                                                            SHA1:8AB4DBABEFD458CEBCD47C2CB144D79804303954
                                                                                                                                                                                                                                            SHA-256:1AEE87904EAAC431C564438807BDBD8FB34290831E7B3C0A502FDF1EF8EAA6A1
                                                                                                                                                                                                                                            SHA-512:EE71A321042F1DFC9660CE84337AB68C50EA40A2B97A0CA7313C433F2DB39769B17039E628B5EA60E3D4FF87DCB3401D98E4670EE82C88920996A641DEA7EFFA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.....................sRGB.........gAMA......a.....pHYs.........j......IDATx^....e.u...}..Y...@P.$.Z....{u...6"Q...@.$H6gI.n..Z"..(.*...J[ .^.gZ..(Q$@..*../......}.y7......../.D..'"n.......@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .......V.z..u.[.#.....4.......[..[....466.fgg

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\finish.png

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):254279
                                                                                                                                                                                                                                            Entropy (8bit):7.968301085693523
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:1QdvglrmnluatdNn508GtXT3YoTkT1ZLw9p2Hpsx/F:2dvglo/nX67HW1ZL8EJ2/F
                                                                                                                                                                                                                                            MD5:B24E872BD8F92295273197602AAC8352
                                                                                                                                                                                                                                            SHA1:2A9B0EBE62E21E9993AA5BFAAADE14D2DDA3B291
                                                                                                                                                                                                                                            SHA-256:41031EFC4F7E322DC5FFACC94B9296FB28B9B922B1CE3B3DA13BF659A5FD2985
                                                                                                                                                                                                                                            SHA-512:F08AC681ABC4E0F6D7A1D1F2303169004E67C880F9353C0ED11DFAB3EB511DDF841FA056F4090DA8201C822C66AE55419C48CD87F11B9866FEB46A3FE2C2AF99
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.....................sRGB.........gAMA......a.....pHYs.........j......IDATx^....f.y...w.......IQ.l..3.,O.'..Lb[".}.bJ.DI...$.j;.D.$....@7z.%;...L..X.,..}m...}..........}o.h,D....{.NU.:u...........@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ ....o.;.o.....m..w.G ..\.h.3.....w..[.VCCCidd

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\is-07QS2.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5627506
                                                                                                                                                                                                                                            Entropy (8bit):7.999949928735462
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:98304:17QO8oAkidb1l/NN3J58UTHPkAbWD56mv9Pb:17Q6A33P8AckWDogJb
                                                                                                                                                                                                                                            MD5:C0EB1D6C28DAD5E8C4C84EDE4284A15A
                                                                                                                                                                                                                                            SHA1:6E7F65E911B9FAB22509F4FCBA000DB0D171A5F3
                                                                                                                                                                                                                                            SHA-256:93BDE5F9A327F6148A48EA1E937D17BCD2A585486CB3D3EA4D69DCAC0F638CBB
                                                                                                                                                                                                                                            SHA-512:E09BE287D71C1D6B84E69EB0234B3D94A6BB64041DDFFAB09B0F9E1F861B0CF4FD82E19C7D36463722C783976A0E992ACA571A10A0BF9EAB6EF80306637A6640
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK...........X....U..dW.....norton_secure_browser_setup.exe.\.|S.....6iRH.@...2......b......L.nJ..Cx..QiM...qns.nn.v?..&..Th.i.:.a.lVez.T...".o.soR......Vxy..=..s.=..s_.'.,.$Y...$..O...]x...u..g..S...??ee..M%.6~...?...?y.SK>..d.vk...,.6P....~..S.n.......3..uc..x8t...s......._.{NP>.....#T>....&......LZ..2.$)..L.$.%.Y...O........8....9<R.............gE....i..g.G...!......8.1...9..-*..).P83...%.t..7}R..$..K..G..r>..#.I.,.tg.)w.C..9.....$i....N.6n.x#..';.b.Z.........?.....}k....Z.......e.n...ER|.U64..9..n.....L....+..../$..dE..Hq.#.?#.J..7.G..Kz..M.K..z..:.c....z..-.e.G;,..........G~..\...w=Z.,..o...+..=].]....H.x..z.=.+....CF..t...[.~.L....3...y..Q?.V52......P...+..U..kG..^ot(.P.....N?..g,X....U!.@n.m.......#%('+F...EH-h.=:......JZ..nmy..G..%}y..u;....|..-.C.J.}..Y.6q....V.@..E.oo>B..%&.n..0......Vu.~.....$...pk.....f*.1^Xc......Y....V..:............G,gC..a.P...2..U..5.t.x..[..X.........Xd.].G.b..}...U.1..S-..x....N!2.Q.z.......

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\is-8K4LP.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):47501
                                                                                                                                                                                                                                            Entropy (8bit):7.9807583617034075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:ymnQh4I8TZIyg23yWlcrF+Dx3hmI7IFrVVzEUxeeizfxEO7Ncc1qB:ymnQCHRg23yQWFyx57IFRVrseizfGEOx
                                                                                                                                                                                                                                            MD5:1CD4A2B4A992ACC9235D9FACD510E236
                                                                                                                                                                                                                                            SHA1:A6F6331879CC8CF0A6F091CC3C66EA95D1425A57
                                                                                                                                                                                                                                            SHA-256:57F2E86B2C8D9C695073CBAED29C674EF748734460A33ED04AC6888B69288B1F
                                                                                                                                                                                                                                            SHA-512:AE2C4AE9E3B46C252D6BB5A9654AB25431D7239D10EF78889452E9292A8B46283AF4319749A7233D08D836B8799CF7A5C0E5AA715A4D7836E4B83167B20F6595
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a...."IDATx.......u&.....h..;.P(P.!..Q.b-hH..e..H.=...+y<.fc..l....7.....w.y......,z>..[..%...-J2..)...4H......^....q.NEe.......%23.....9'".<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<f..Rd....z..^.UH.Xf.=W-')M....g...=<<<<<..hA....'...^.-.....u...MWo9n:..%....mR...*...}.hLf...xxxxx.;@P.J...B.t[*.w..6.4:L.[..n~]~R..:.4n....62......1O &.J.T...;w....>s.{7]...<I..N.I...>)_.P...E.u.......!.4q.g]g...J..........(.f...0!..>)..W.:L..p}.t...TfR...%.R..>;yK.U.v...,#<...2...|....\. ..;..C.......1...(_...z.C|.....1...f.;.}......Cx<....qW8tC.r.G.\.... n......<<<<<..J...;.....|.;.... ^.X.9\......^......[NI.:,....:.SvF.Y.h...u......#GC......4!.n......P0q.k.A.(.n..i}td.PX......8.$!a...qEI................O......A.O(...@<.iL ....$.Y.f....U.p.c.:.....@...T..4.."n.M.....G:..o(mB.SO=%e..H....&...0\K.x|.p.....:.<ukHf.L..HDD.a..m....I.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\is-DUJO1.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):53151
                                                                                                                                                                                                                                            Entropy (8bit):7.982330941208071
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:GcHlp3vMusTtWEgKqx8zHom+GChNPDViFKWUyG:Ggz3kTNgKq66VcFKW9G
                                                                                                                                                                                                                                            MD5:AEE8E80B35DCB3CF2A5733BA99231560
                                                                                                                                                                                                                                            SHA1:7BCF9FEB3094B7D79D080597B56A18DA5144CA7B
                                                                                                                                                                                                                                            SHA-256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
                                                                                                                                                                                                                                            SHA-512:DCD84221571BF809107F7AEAF94BAB2F494EA0431B9DADB97FEED63074322D1CF0446DBD52429A70186D3ECD631FB409102AFCF7E11713E9C1041CAACDB8B976
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a....4IDATx.......y...u.}...W."..(s ........p.........Q...?ql=...'.8....E.l...Y.-ah..FP.w.......__uUwuw.r.3X.z..........jcppph........O.appp..........n ..qph..88.......pd...y...!..888.##...._..C.8....Cn82...,.8...40....!7..qph..GF.2.........C.h....q#.........!7..qph.O..../_..p......B....K...`.XF.n}........S/b.._..?.XH.2q...i.}..y....c...8..b|~:WY...8....a......o...v..!.~.+8z...P.....y......2y^....!.w..C.=..'.J]..v. ..}./o..q....M...........<$.X.<)..g.gp......'.Y.I...'.x......D.(..C...m.. .:.#....$. .LdD.E...*..a..}..eih.A.....AyR...7a..2..N##DD^....Tg...;>$..tZo.....m......3.A..p....$MM.".hF.......qpX....7..F.=.k..e".G/...G~E.........4..kA.{....yN.dH)~.s...........#.W...lD.:..W}...#...kP.&...;....n......?..d....oH.....#..'a..s..D.....<.......h...y.....D..!.^...G....4.........c .;?$..6...@.....O c.......~.u...1.7......c.|..'...?/..#;.z&....T.M4.w.."....7W....

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\is-G7T04.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):48743
                                                                                                                                                                                                                                            Entropy (8bit):7.952703392311964
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
                                                                                                                                                                                                                                            MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
                                                                                                                                                                                                                                            SHA1:0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
                                                                                                                                                                                                                                            SHA-256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
                                                                                                                                                                                                                                            SHA-512:9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..|.....{l\tO.|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.|.......?..#......2vO....F......@.|..w7].|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`|..?.....?...{..~~........).........`$.......tG....|.n.2..........[..._....e.}.=..<........h.7|?Kg....+

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\is-M1T9T.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):527389
                                                                                                                                                                                                                                            Entropy (8bit):7.995975187354872
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
                                                                                                                                                                                                                                            MD5:F68008B70822BD28C82D13A289DEB418
                                                                                                                                                                                                                                            SHA1:06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
                                                                                                                                                                                                                                            SHA-256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
                                                                                                                                                                                                                                            SHA-512:FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.l*z..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.|.....$....^.YR..R...<.`..*...l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\is-OOKAN.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):125405
                                                                                                                                                                                                                                            Entropy (8bit):7.996684823256823
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
                                                                                                                                                                                                                                            MD5:56B0D3E1B154AE65682C167D25EC94A6
                                                                                                                                                                                                                                            SHA1:44439842B756C6FF14DF658BEFCCB7A294A8EA88
                                                                                                                                                                                                                                            SHA-256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
                                                                                                                                                                                                                                            SHA-512:6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK.........XQW.a..............avg_antivirus_free_setup.exe.].|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..*BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.|.7.>..Kx..d.{J*./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\logo.png

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):254078
                                                                                                                                                                                                                                            Entropy (8bit):7.968268860206608
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:d9rAhuSnngAZK0u2vGWTbQ8VreGWVQx1RiiHs0dfo5yk5BRFOYfKa5ubF3/hlKHV:U/HJGWPQ2wV01RPQ5FoBJc+uHtjdhd3
                                                                                                                                                                                                                                            MD5:9CC8A637A7DE5C9C101A3047C7FBBB33
                                                                                                                                                                                                                                            SHA1:5E7B92E7ED3CA15D31A48EBE0297539368FFF15C
                                                                                                                                                                                                                                            SHA-256:8C5C80BBC6B0FDB367EAB1253517D8B156C85545A2D37D1EE4B78F3041D9B5DB
                                                                                                                                                                                                                                            SHA-512:CF60556817DBA2D7A39B72018F619B0DBEA36FB227526943046B67D1AE501A96C838D6D5E3DA64618592AC1E2FA14D4440BAA91618AA66256F99EA2100A427B4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.PNG........IHDR.....................sRGB.........gAMA......a.....pHYs.........j......IDATx^....f.y....:=....H..d[f....I.$.........)..%E7.o..H.H..@...f.%;..{.\_.%R...e.}.........N.t...B....]u...SU_....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .....@ .x..mKU....[6..8..@.RA...@ ...#l.....N..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0 (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):527389
                                                                                                                                                                                                                                            Entropy (8bit):7.995975187354872
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
                                                                                                                                                                                                                                            MD5:F68008B70822BD28C82D13A289DEB418
                                                                                                                                                                                                                                            SHA1:06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
                                                                                                                                                                                                                                            SHA-256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
                                                                                                                                                                                                                                            SHA-512:FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.l*z..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.|.....$....^.YR..R...<.`..*...l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0.zip (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):527389
                                                                                                                                                                                                                                            Entropy (8bit):7.995975187354872
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
                                                                                                                                                                                                                                            MD5:F68008B70822BD28C82D13A289DEB418
                                                                                                                                                                                                                                            SHA1:06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
                                                                                                                                                                                                                                            SHA-256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
                                                                                                                                                                                                                                            SHA-512:FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.l*z..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.|.....$....^.YR..R...<.`..*...l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\installer.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25583888
                                                                                                                                                                                                                                            Entropy (8bit):7.991553814165531
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:393216:Nd8MM+oA8smlLC8Ao9/q0DNUs8lUYXuPGhZBJsbfQ/fRtSjBul:NdEZlsmlWcxqgmbuuhZCQRtStul
                                                                                                                                                                                                                                            MD5:46C50DC50D9BE92829B9D6FD4678C11D
                                                                                                                                                                                                                                            SHA1:3C0B0493B9E6269A1A00C48720C7FD97C04DDD4F
                                                                                                                                                                                                                                            SHA-256:D9C15D4A7E2B1A320154A5C61AF012242E3408A5C5519CBB4E93A7843692CF50
                                                                                                                                                                                                                                            SHA-512:340FDBC7618E86EF4178142AA9012AB9317869B85AC148FCD31C0C2FFF007114EACCBF60EE829BE99890D36B7D5E1A78C4617E40A538735A8B01002D4D5E41E9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.K=0.%n0.%n0.%nk.&o:.%nk.!o".%nk. o..%nb.!o .%nb.&o:.%nb. oj.%nk.$o5.%n0.$n..%n..,o<.%n...n1.%n..'o1.%nRich0.%n........................PE..d...^2.f.........."..........4.................@.............................@......<.....`..................................................$..(....... V}.....|2..........0......p...p.......................(.......8...............p...."..`....................text............................... ..`.rdata..V...........................@..@.data....1...@......................@....pdata..|2.......4...6..............@..@_RDATA...............j..............@..@.rsrc... V}......X}..l..............@..@.reloc.......0.....................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1184128
                                                                                                                                                                                                                                            Entropy (8bit):6.623147525519113
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
                                                                                                                                                                                                                                            MD5:143255618462A577DE27286A272584E1
                                                                                                                                                                                                                                            SHA1:EFC032A6822BC57BCD0C9662A6A062BE45F11ACB
                                                                                                                                                                                                                                            SHA-256:F5AA950381FBCEA7D730AA794974CA9E3310384A95D6CF4D015FBDBD9797B3E4
                                                                                                                                                                                                                                            SHA-512:C0A084D5C0B645E6A6479B234FA73C405F56310119DD7C8B061334544C47622FDD5139DB9781B339BB3D3E17AC59FDDB7D7860834ECFE8AAD6D2AE8C869E1CB9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......2..}vn..vn..vn..-../xn..-../.n..$../bn..$../on..G2r.tn..$../.n..-../on..-../wn..-../yn...../wn...../~n...../Zn..vn..=o...../{n...../hn....p.wn...../wn..Richvn..................PE..L...V..e.....................h...... .............@..................................1....@.............................................p...............................p...................@.......X...@...............0....... ....................text............................... ..`.rdata..............................@..@.data..............................@....didat...............T..............@....rsrc...p............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1 (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):125405
                                                                                                                                                                                                                                            Entropy (8bit):7.996684823256823
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
                                                                                                                                                                                                                                            MD5:56B0D3E1B154AE65682C167D25EC94A6
                                                                                                                                                                                                                                            SHA1:44439842B756C6FF14DF658BEFCCB7A294A8EA88
                                                                                                                                                                                                                                            SHA-256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
                                                                                                                                                                                                                                            SHA-512:6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:PK.........XQW.a..............avg_antivirus_free_setup.exe.].|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..*BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.|.7.>..Kx..d.{J*./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1.zip (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):125405
                                                                                                                                                                                                                                            Entropy (8bit):7.996684823256823
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
                                                                                                                                                                                                                                            MD5:56B0D3E1B154AE65682C167D25EC94A6
                                                                                                                                                                                                                                            SHA1:44439842B756C6FF14DF658BEFCCB7A294A8EA88
                                                                                                                                                                                                                                            SHA-256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
                                                                                                                                                                                                                                            SHA-512:6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:PK.........XQW.a..............avg_antivirus_free_setup.exe.].|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..*BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.|.7.>..Kx..d.{J*./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):234936
                                                                                                                                                                                                                                            Entropy (8bit):6.580764795165994
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:y2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhh3K0Ko:y0KgGwHqwOOELha+sm2D2+UhngNdK4d
                                                                                                                                                                                                                                            MD5:26816AF65F2A3F1C61FB44C682510C97
                                                                                                                                                                                                                                            SHA1:6CA3FE45B3CCD41B25D02179B6529FAEDEF7884A
                                                                                                                                                                                                                                            SHA-256:2025C8C2ACC5537366E84809CB112589DDC9E16630A81C301D24C887E2D25F45
                                                                                                                                                                                                                                            SHA-512:2426E54F598E3A4A6D2242AB668CE593D8947F5DDB36ADED7356BE99134CBC2F37323E1D36DB95703A629EF712FAB65F1285D9F9433B1E1AF0123FD1773D0384
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L....m6d.........."..........\...... ........0....@.................................V.....@........................................................Hl..p)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...............................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2 (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5627506
                                                                                                                                                                                                                                            Entropy (8bit):7.999949928735462
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:98304:17QO8oAkidb1l/NN3J58UTHPkAbWD56mv9Pb:17Q6A33P8AckWDogJb
                                                                                                                                                                                                                                            MD5:C0EB1D6C28DAD5E8C4C84EDE4284A15A
                                                                                                                                                                                                                                            SHA1:6E7F65E911B9FAB22509F4FCBA000DB0D171A5F3
                                                                                                                                                                                                                                            SHA-256:93BDE5F9A327F6148A48EA1E937D17BCD2A585486CB3D3EA4D69DCAC0F638CBB
                                                                                                                                                                                                                                            SHA-512:E09BE287D71C1D6B84E69EB0234B3D94A6BB64041DDFFAB09B0F9E1F861B0CF4FD82E19C7D36463722C783976A0E992ACA571A10A0BF9EAB6EF80306637A6640
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:PK...........X....U..dW.....norton_secure_browser_setup.exe.\.|S.....6iRH.@...2......b......L.nJ..Cx..QiM...qns.nn.v?..&..Th.i.:.a.lVez.T...".o.soR......Vxy..=..s.=..s_.'.,.$Y...$..O...]x...u..g..S...??ee..M%.6~...?...?y.SK>..d.vk...,.6P....~..S.n.......3..uc..x8t...s......._.{NP>.....#T>....&......LZ..2.$)..L.$.%.Y...O........8....9<R.............gE....i..g.G...!......8.1...9..-*..).P83...%.t..7}R..$..K..G..r>..#.I.,.tg.)w.C..9.....$i....N.6n.x#..';.b.Z.........?.....}k....Z.......e.n...ER|.U64..9..n.....L....+..../$..dE..Hq.#.?#.J..7.G..Kz..M.K..z..:.c....z..-.e.G;,..........G~..\...w=Z.,..o...+..=].]....H.x..z.=.+....CF..t...[.~.L....3...y..Q?.V52......P...+..U..kG..^ot(.P.....N?..g,X....U!.@n.m.......#%('+F...EH-h.=:......JZ..nmy..G..%}y..u;....|..-.C.J.}..Y.6q....V.@..E.oo>B..%&.n..0......Vu.~.....$...pk.....f*.1^Xc......Y....V..:............G,gC..a.P...2..U..5.t.x..[..X.........Xd.].G.b..}...U.1..S-..x....N!2.Q.z.......

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2.zip (copy)

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5627506
                                                                                                                                                                                                                                            Entropy (8bit):7.999949928735462
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:98304:17QO8oAkidb1l/NN3J58UTHPkAbWD56mv9Pb:17Q6A33P8AckWDogJb
                                                                                                                                                                                                                                            MD5:C0EB1D6C28DAD5E8C4C84EDE4284A15A
                                                                                                                                                                                                                                            SHA1:6E7F65E911B9FAB22509F4FCBA000DB0D171A5F3
                                                                                                                                                                                                                                            SHA-256:93BDE5F9A327F6148A48EA1E937D17BCD2A585486CB3D3EA4D69DCAC0F638CBB
                                                                                                                                                                                                                                            SHA-512:E09BE287D71C1D6B84E69EB0234B3D94A6BB64041DDFFAB09B0F9E1F861B0CF4FD82E19C7D36463722C783976A0E992ACA571A10A0BF9EAB6EF80306637A6640
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:PK...........X....U..dW.....norton_secure_browser_setup.exe.\.|S.....6iRH.@...2......b......L.nJ..Cx..QiM...qns.nn.v?..&..Th.i.:.a.lVez.T...".o.soR......Vxy..=..s.=..s_.'.,.$Y...$..O...]x...u..g..S...??ee..M%.6~...?...?y.SK>..d.vk...,.6P....~..S.n.......3..uc..x8t...s......._.{NP>.....#T>....&......LZ..2.$)..L.$.%.Y...O........8....9<R.............gE....i..g.G...!......8.1...9..-*..).P83...%.t..7}R..$..K..G..r>..#.I.,.tg.)w.C..9.....$i....N.6n.x#..';.b.Z.........?.....}k....Z.......e.n...ER|.U64..9..n.....L....+..../$..dE..Hq.#.?#.J..7.G..Kz..M.K..z..:.c....z..-.e.G;,..........G~..\...w=Z.,..o...+..=].]....H.x..z.=.+....CF..t...[.~.L....3...y..Q?.V52......P...+..U..kG..^ot(.P.....N?..g,X....U!.@n.m.......#%('+F...EH-h.=:......JZ..nmy..G..%}y..u;....|..-.C.J.}..Y.6q....V.@..E.oo>B..%&.n..0......Vu.~.....$...pk.....f*.1^Xc......Y....V..:............G,gC..a.P...2..U..5.t.x..[..X.........Xd.].G.b..}...U.1..S-..x....N!2.Q.z.......

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5727368
                                                                                                                                                                                                                                            Entropy (8bit):7.987929042344586
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:BiykuiGAGbjNHbd5lbDK4pdfAstezXYCvzV:BiyKGBZhKEmyezIUR
                                                                                                                                                                                                                                            MD5:F269C5140CBC0E376CC7354A801DDD16
                                                                                                                                                                                                                                            SHA1:BBCEEF9812A3E09D8952E2FE493F156E613837B2
                                                                                                                                                                                                                                            SHA-256:5AE1ACF84F0A59FA3F54284B066E90C8432071ACE514ACCB6303261D92C6A910
                                                                                                                                                                                                                                            SHA-512:BA271257C0DBFBFD63685449A5FA5EA876B31C4F1898F85AA1BE807F1E31846D12F2162F715FC320FB014D31C15501EA71FE73B3C981E201BFA1A448FF54745C
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV.*_...PV..PW.MPV.*_...PV.sf..PV..VP..PV.Rich.PV.........PE..L......].................f...*.......5............@.................................$.X...@..............................................(...........;W..(...........................................................................................text...{d.......f.................. ..`.rdata...............j..............@..@.data...X............~..............@....ndata...................................rsrc....(.......*..................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\zbShieldUtils.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2060288
                                                                                                                                                                                                                                            Entropy (8bit):6.611521905910169
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:a4yxp/wFOn9xRo3HVCEi2ynjsPAXkp4K0x8BFuchaFotKLIk:aJTwo93o3UEi2ynjs4Up4KI8BFucME
                                                                                                                                                                                                                                            MD5:3037E3D5409FB6A697F12ADDB01BA99B
                                                                                                                                                                                                                                            SHA1:5D80D1C9811BDF8A6CE8751061E21F4AF532F036
                                                                                                                                                                                                                                            SHA-256:A860BD74595430802F4E2E7AD8FD1D31D3DA3B0C9FAF17AD4641035181A5CE9E
                                                                                                                                                                                                                                            SHA-512:80A78A5D18AFC83BA96264638820D9EED3DAE9C7FC596312AC56F7E0BA97976647F27BD86EA586524B16176280BD26DAED64A3D126C3454A191B0ADC2BC4E35D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......c./}'.A.'.A.'.A.l.B/:.A.l.F/&.A.l.E/..A.l.D/..A.l.G/&.A.l.@/..A.'.@.-.A.u.E/5.A.u.B/?.A.u.D/Y.A..H/$.A..A/&.A...&.A.'...&.A..C/&.A.Rich'.A.........................PE..L...i..f...........!.....f...N............................................................@.........................0...........T........A..............................p...............................@............................................text....e.......f.................. ..`.rdata..>L.......N...j..............@..@.data............Z..................@....rsrc....A.......B..................@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm770F.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):18749398
                                                                                                                                                                                                                                            Entropy (8bit):5.540150296150122
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:pP8TvkTLVTAudcoJheBnknfFrqNVMuEdpucFwL9z2a7deJfRc6cWljaF9IU+Js:zXBAudcoJ59rqNVMy2G6TS9I1J
                                                                                                                                                                                                                                            MD5:78904B99D2C9AC6CA1B032CDEDED3816
                                                                                                                                                                                                                                            SHA1:18E5A79B33D5A47536CFC21DE500949530B5A060
                                                                                                                                                                                                                                            SHA-256:4043AF6E29B8C64380A471B6D4F74462421925DC3501FF26C1A629B3753B091C
                                                                                                                                                                                                                                            SHA-512:0F35D1C96E672CEC9F8479F65616B061A07A52FC9333C4457CDE80EE67C133D871D38636EB7ED39931D6E6050A540767B74F957D0016220D213797EA92980BB6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.vs.....,....................{....a......Cs.,....vs..............................................................i...o..{o...o..............................................................................................................................................................................x...j...............................................................................................................................G.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\AccessControl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26848
                                                                                                                                                                                                                                            Entropy (8bit):6.652871453473559
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:qflzhxZBcukmxQN2NMBMLh2ES+9DlJshjJy0swiEVAM+o/8E9VF0Ny29:8lvcu7x7uB2R9pih1y06EVAMxkE
                                                                                                                                                                                                                                            MD5:39B6A146E9DAAE870A394530B5723E96
                                                                                                                                                                                                                                            SHA1:2E62DBE3A1BD65BFA245E38021F8BAEB24EA3291
                                                                                                                                                                                                                                            SHA-256:2A3C3830996953E592FDC67B1F4B4F3B4194F5CA28929E577297A72A58C84A84
                                                                                                                                                                                                                                            SHA-512:5C27896FAC5B37A0856379323EDA80F52154F1335DA86A966E62E28366D613687C193B6A8E37DF9C6285B1AD8137D9F4F01A550D02E74A5C4847310FAB482354
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9[..X5.X5.X5. ..X5.X4..X5.?1<.X5.?15.X5.?1..X5.?17.X5.Rich.X5.........PE..L...BcL^...........!......... .......*.......0......................................S.....@.........................p<......|@..P....`..............H@...(...p.......<..T............................................0...............................text...I........................... ..`.rdata.......0....... ..............@..@.data...L....P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\CR.History.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):126976
                                                                                                                                                                                                                                            Entropy (8bit):0.47147045728725767
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                                                                                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                                                                                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                                                                                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                                                                                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\FF.places.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5242880
                                                                                                                                                                                                                                            Entropy (8bit):0.037963276276857943
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
                                                                                                                                                                                                                                            MD5:C0FDF21AE11A6D1FA1201D502614B622
                                                                                                                                                                                                                                            SHA1:11724034A1CC915B061316A96E79E9DA6A00ADE8
                                                                                                                                                                                                                                            SHA-256:FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
                                                                                                                                                                                                                                            SHA-512:A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\JsisPlugins.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2160856
                                                                                                                                                                                                                                            Entropy (8bit):6.779350356047654
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:SdpuUEAFwL9cgRCbajymTn920aBa7deTlfRXAF3bHQpobMAjY5kH:SdpucFwL9zymTn920aBa7deJfRgbHQu1
                                                                                                                                                                                                                                            MD5:916F3D54B2714E4129A786CE128DBE0B
                                                                                                                                                                                                                                            SHA1:B2914CADC19CD87F1FA005D9216F6AD437FE73AD
                                                                                                                                                                                                                                            SHA-256:9B2FB069FAD6A9422808C1526328A1D6305573BE9EBCC3AEAB7A38664D02AC6D
                                                                                                                                                                                                                                            SHA-512:8C05F71E55D6B5F1DD797DEE852183BDBD7D7EB8D36B760C5C7413BC79D5F2C8300C41AC3DEB76F2AA497D8C86434F04F3A7DD17EA65D0E44CA5FB8E59F62416
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............e...e...e..xf...e..x`.m.e.ka...e.kf...e.k`...e..B....e..xa...e..j`...e..xc...e..xd...e...d...e.ka...e.k`...e.ke...e.k....e.......e.kg...e.Rich..e.........PE..L....5.d...........!.........*.......s....................................... !......S!...@.........................................................H. ..(.... ......G..T....................H.......H..@............................................text............................... ..`.rdata..............................@..@.data...(...........................@....rsrc...............................@..@.reloc........ .....................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\Midex.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):129760
                                                                                                                                                                                                                                            Entropy (8bit):6.686100620416484
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:wACUTz1JlJmpGB6yK4H9l4o8rr4YlixbSrZKbazG+k:wACUTz1JlopG5K4OZgeC9
                                                                                                                                                                                                                                            MD5:18198BAE7294424D3607F776F5EF7B0F
                                                                                                                                                                                                                                            SHA1:5EBC82D4C91ED2736F98AED57EB8578F0F225C33
                                                                                                                                                                                                                                            SHA-256:6078F5FDCC332F617773AAE89AC3DB0888A0360A32BB6D9431D716471D1C480F
                                                                                                                                                                                                                                            SHA-512:507D625C0643165B12A2C0EA01765445AD632136DA0A40B14EC36B0E1794D3ECE43CE482B5E4C9281565AE3BF226C60FBA5A25C085430EC5F1D17B7563CAA4A8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................\P5.....\P7....\P6........................W............r.......r.......r.;.......S.....r.......Rich....................PE..L....lL^...........!.....:...........E.......P............................... ......"-....@.........................0...D...t...<...................H....(.......... ...T...........................x...@............P..L............................text....9.......:.................. ..`.rdata...p...P...r...>..............@..@.data...t...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1910576
                                                                                                                                                                                                                                            Entropy (8bit):7.58137479903026
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:hbGcPcWSOwiGJ+aKznZOqbU3tFKU+9wOKXd9AVjrr:xGGcWSYGJ+94iU3tIU+qOs
                                                                                                                                                                                                                                            MD5:2B07E26D3C33CD96FA825695823BBFA7
                                                                                                                                                                                                                                            SHA1:EBD3E4A1A58B03BFD217296D170C969098EB2736
                                                                                                                                                                                                                                            SHA-256:2A97CB822D69290DF39EBAA2F195512871150F0F8AFF7783FEA0B1E578BBB0BA
                                                                                                                                                                                                                                            SHA-512:1B204322ACA2A66AEDF4BE9B2000A9C1EB063806E3648DBAB3AF8E42C93CA0C35E37A627802CD14272273F3F2E9BC55847DFA49FC6E8FFB58F39683E2446E942
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].T...:...:...:...9...:...?...:...>...:.K.>...:.K.9...:.K.?.).:.A.3...:...;...:...;.n.:.A....:......:.A.8...:.Rich..:.................PE..L...]..d.................n...J.......R............@.................................u.....@.....................................x.... ..|...........H....j..............T...........................@...@............................................text....m.......n.................. ..`.rdata..Fr.......t...r..............@..@.data...............................@....rsrc...|.... ......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\StdUtils.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):200416
                                                                                                                                                                                                                                            Entropy (8bit):6.688698057656482
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:sRXOjZpSOAPrzjyfvwyYUDBftoJiEqNuozAsWFFowXV8xBY90JZx4INb54UVuH7d:OOdpSOGvWjbLtBwF8TJL4IxVuH7xlh
                                                                                                                                                                                                                                            MD5:F2AAC54C495BD4566228E5CC2CBBFE97
                                                                                                                                                                                                                                            SHA1:3DBFCA2AB60C17B1A0FCF3E6B8EE7AD18173FED7
                                                                                                                                                                                                                                            SHA-256:22AE097B02F02A7C2151B113DD5756965D3857A148DF19C745D4DA2A4887B292
                                                                                                                                                                                                                                            SHA-512:FEFFFD62B4735D7AF459A771FFB73AF8AB0BE8CD08C1BA6B009D28CF9F97AD138976F628AE28600CCA0FF10B7FFFA63B94E34EF4328623A28F8088F028597BFA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........f.................................x...g,.....,.......,.................a..........,......e......e.......e...............e.......Rich....................PE..L.....l^...........!................\........0............................... ............@............................T...$.......................H....(..........0...T...................,...........@............0...............................text...8........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\inetc.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):38112
                                                                                                                                                                                                                                            Entropy (8bit):6.31022202046075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:sEE9m7Lbg4nqAYYDqAvELv5TGjgy06EqAMxkE:sEJnbpnBDBED5TjxIx
                                                                                                                                                                                                                                            MD5:5FDB8BD2FE89ED7B03F2DBE64D5F51EC
                                                                                                                                                                                                                                            SHA1:355AF194C6C003ADD61808F7D65C104C3B221AC5
                                                                                                                                                                                                                                            SHA-256:4A926AAD3FD97366E164E92CC0D37F76E6ED348757F72EDA499C3DE19671BCE3
                                                                                                                                                                                                                                            SHA-512:FA177B5710E2479C59E7E0A6047D69C09D565905105D08F983840B0E77209DB0B8DF6646FE9827997619015888B536F7CC0B1654F6AAD383B2A571C4694274E1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.q,z.q,z.q,...,s.q,z.p,/.q,..t-x.q,..u-{.q,..q-{.q,...,{.q,..s-{.q,Richz.q,........................PE..L...B.b^...........!.....6...|.......2.......P............................................@..........................W..l...xY..d...................Hl...(......p...PW..T............................................P..p............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data....V...p.......L..............@....rsrc................Z..............@..@.reloc..p............d..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\jsis.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):130784
                                                                                                                                                                                                                                            Entropy (8bit):6.313676957875236
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:33Zk9fOAewM0+W8NVH28fB948igEWo8P+fidx:33qNOApM1G8fBpidWZ
                                                                                                                                                                                                                                            MD5:4A98ACC5AD0E701E3289231FDB253A5D
                                                                                                                                                                                                                                            SHA1:A8E7452658EA0777CF838FEE2ABEC806B147E832
                                                                                                                                                                                                                                            SHA-256:E9B0AF410098EFA3848CCCA171C6933C70FF06B241F3806FD3816EAB5757BEB6
                                                                                                                                                                                                                                            SHA-512:1213061966D9858467CEEA746EEE2A00CA381CC693457E347D58BEF7996DAD4F5EE7412FCC2A4E48F96256445D966141F2BCA993132FCE4402142A57114D8AB3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.Q.'.?.'.?.'.?.....4.?.'.>...?...;.2.?...?.&.?.....&.?...=.&.?.Rich'.?.................PE..L...^<.e...........!......................... ............................... ............@......................... #......`6......................H....(..........."..T............................................ ...............................text............................... ..`.rdata..@%... ...&..................@..@.data........P.......8..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\jsisdl.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25816
                                                                                                                                                                                                                                            Entropy (8bit):6.714415723163507
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:Ej42b45gg3PClGaGU8D1sNy06EdAMxkE6:Ej42bggA6bg1yx1xW
                                                                                                                                                                                                                                            MD5:E149A8BCD017059151E37881A442ECBE
                                                                                                                                                                                                                                            SHA1:53AFEE6CC4B8098BE98B199D6B2148B0B48D247A
                                                                                                                                                                                                                                            SHA-256:2AA66C5745BBF99412C735C601B9592DCE1EF6C888D76EC0FD817D580EB0CB07
                                                                                                                                                                                                                                            SHA-512:8F8340678C78F2BA1C4D18F6A108B97F0516A32EF379735C7DAC5B23595B809DEC3FCA87551B107E33637B56107540293166729325BC6EF131C0F968278A61C2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9]..X3.X3.X3. ..X3.X2.X3.?1;.X3.?13.X3.?1..X3.?11.X3.Rich.X3.........PE..L.....b^...........!.........R.......%.......0.......................................f....@..........................0..d....2..P...................H<...(...........0..T............................................0...............................text............................... ..`.rdata.......0......."..............@..@.data....D...@.......(..............@....rsrc................4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\nsJSON.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):37600
                                                                                                                                                                                                                                            Entropy (8bit):6.707926977853279
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:K1vTYFHvlhqjbm8oEHB6hC+/3P4LA27bRpqy06EHAMxkEk:K1bYPHqu7EUhL27bT8xnxw
                                                                                                                                                                                                                                            MD5:52B19EAA9500F892FD83F8012D705701
                                                                                                                                                                                                                                            SHA1:FB06D3004A4AC2C937E878A0AC3285ECE4E305FE
                                                                                                                                                                                                                                            SHA-256:081F0B9830921894DF2D8920AF6D7069C8F2298622AFC954731A58C4E2423391
                                                                                                                                                                                                                                            SHA-512:82632417A41D9F593C62B8E850E824749BABCF3480C5663767477097B27C680A72CAECBCB7C9F88061FA2C998A99FB3DAFB5A5796CAB464DF4E945FA93D267B6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>E..P...P...P.......P...Q...P...X...P...P...P.......P...R...P.Rich..P.................PE..L....6.a...........!.....H...........*.......`............................................@.........................pi..H....l..d...................Hj...(...........i..T............................................`...............................text...AF.......H.................. ..`.rdata.......`.......L..............@..@.data...$............^..............@....rsrc................`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\reboot.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26840
                                                                                                                                                                                                                                            Entropy (8bit):6.837130188655359
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:NimyF0m1ZSB69hT0JLbQjCPR28t5zKIBPUJy0swiEv9AM+o/8E9VF0NyTP2:Nil2EOPQATrRBcy06Ev9AMxkE92
                                                                                                                                                                                                                                            MD5:B951C5DE3420EA1B7FC980DE0F16A606
                                                                                                                                                                                                                                            SHA1:47729AD26FBDDEE96DD5D29E161852CEA5B94A25
                                                                                                                                                                                                                                            SHA-256:7CD1263FAE809FF7BD3F359008661314C9D35C1F6062AF9C81C3130F562BC2AE
                                                                                                                                                                                                                                            SHA-512:D3C5D890A550B884C81A5C2A2A19E25E7A6BAEA9E2C13AD5A8D5B624D21FF5865253354D1AE60F7CA1D088AC2035EB4D4585A9AF16C549AF89DC0D7FFCF2CB74
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.0.>f^.>f^.>f^.7...7f^.>f_. f^...Z.8f^...^.?f^.....?f^...\.?f^.Rich>f^.........PE..L...c.b^...........!.....*...........4.......@............................................@..........................@..`....B..d....`..............H@...(...p.. ....@..T............................................@...............................text....(.......*.................. ..`.rdata.......@......................@..@.data...0....P.......4..............@....rsrc........`.......8..............@..@.reloc.. ....p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\remoteResponse.json

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):763
                                                                                                                                                                                                                                            Entropy (8bit):4.7421079544986515
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:YiKwpqL1sjhSG2qwpHgZaJzjQBGBrwTSJ0GddZaExdcuevifHZAIDO6:YiKwkHgI5sMBu6BdKEXe6vZ1DF
                                                                                                                                                                                                                                            MD5:57CF4FD0252010F496CE5ED40455AC04
                                                                                                                                                                                                                                            SHA1:1C8DD7A33D88BEFF346C9C07D9CA8BD23F921FEA
                                                                                                                                                                                                                                            SHA-256:CA8B1F6CAA45A26830C57BD0F9217CF482BEDD981710A2C4A8ABC3DFC30D8000
                                                                                                                                                                                                                                            SHA-512:080E690A71BD497902FC8942BA187BF70B8C2BAE6B4E495CB2EE676FF562653EA6FD4011CD14C69BD9069B5DAB22FAFDEAD86617100D791E86F9EC05BEB7147C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:{"av_extensions_native":"lhnnoklckomcfdlknmjaenoodlpfdclc,dmfdacibleoapmpfdgonigdfinmekhgp","campaign_group_id":"2911","campaign_id":"29239","country_code":"US","register_install":1,"remote_disable":"0","request_uuid":"25d6e5f58e5b4ab1b6eeb716664ff4ad","search_provider":"yahoo.com","search_provider_google_client_id":"NULL","setting_enable_bankmode":1,"setting_force_default_win10":"1","setting_heartbeat_install":1,"setting_import_cookies":"1","setting_import_settings":"2","setting_install_background":"0","setting_launch_install":"1","setting_launch_logon":"1","setting_popular_shortcuts_v2":"0","setting_shortcut_desktop":"1","setting_shortcut_startmenu":"1","setting_shortcut_taskbar":"1","update_retries":2,"utc_date":"20241013","utc_timestamp":1728855871}

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\sciterui.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6398680
                                                                                                                                                                                                                                            Entropy (8bit):6.757721296323737
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:yTvkQ/nTstrpzpNBcSrMVudcoCL+34a5eB2atknfQJlH7ixiu1aqrqNCwL9BlK5p:yTvkTLVTAudcoJheBnknfFrqNVMu
                                                                                                                                                                                                                                            MD5:269EDAF14B5B99A0869A5480DEC9D9D2
                                                                                                                                                                                                                                            SHA1:B9F8CE759CADA0874EA2181751E05899658E34BC
                                                                                                                                                                                                                                            SHA-256:9752FAB0F93CF571407A4954ED46C0D5F5B1A858BEBD551231D2D21C707BEF70
                                                                                                                                                                                                                                            SHA-512:682AE7AE6B4A03DC0EE447E35DA73EF0CFC488984047FD6551D89634382A10F18F84A84B9868484CF1586AEF35634C00F5D3CA083954954127DC59992C33E2DD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..............|~..............|......Rich............PE..L...3I.e...........!.........xa...............................................a.......a...@.......................................... ..8ta.........Hza..(..............T............................................................................rdata..............................@..@.rsrc...8ta.. ...va.................@..@....3I.e........_...T...T.......3I.e........................3I.e........T...........RSDS..i....E../'.K......D:\work\d58bb94b48143cdc\Contrib\build\out\x86\MinSizeRel\sciterui.pdb..............................T....rdata..T........rdata$zzzdbg.... ..P....rsrc$01....P!...ra..rsrc$02................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\thirdparty.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):95968
                                                                                                                                                                                                                                            Entropy (8bit):6.540971049765208
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:uqNkPugFq0hRqcS+rYS0wreCmbsWmXKcdCbAKPz7VPxzxm:uqN0u8q0hRqhcelwXLyAKPz79W
                                                                                                                                                                                                                                            MD5:5D1F1A9575A20E6273D3F1553378DA7C
                                                                                                                                                                                                                                            SHA1:97E28C80F8C4DED7F91198B677A02491158F85EE
                                                                                                                                                                                                                                            SHA-256:DD9B241E2F8CDC6C9A098AF68EC462850EBBC4391ED57967B37A4CCBC0100A27
                                                                                                                                                                                                                                            SHA-512:14BD97CBD1328010E9D613EE1CEC13A9C7008F7C26739C5B054B77D6BF2A41FE8B73FD6D9438228DAE70632838AF898AF26B5A0A73A1387E8E4F5FB7A3CD8AC5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f......................................................,.......,......,.......................................Rich............PE..L....d._...........!.................g...............................................c....@......................... >..|....?......................HN...(......`....6..T...........................(7..@...............t............................text............................... ..`.rdata...g.......h..................@..@.data....2...P.......0..............@....rsrc................8..............@..@.reloc..`............<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsp8B64.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):700
                                                                                                                                                                                                                                            Entropy (8bit):4.727166525039482
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:YWLSHkawuhTpOPWJn9wuhzVuPWJe9zwuhkPWJECwuhD7PWJGwuhzPWGk+c94GniX:YWLSHk/DOJeQVuOJe9cnOJAs7OJ7oOGn
                                                                                                                                                                                                                                            MD5:359CCE9C2DF62868BF4096E887993CB7
                                                                                                                                                                                                                                            SHA1:F3683EE9E7ED5CFC3570D9AAF769EEF6F4FA3A95
                                                                                                                                                                                                                                            SHA-256:FCD6CEBFE6E9D8BDDF1C4B09771D7D849F2FDC105F991337E45D6AA82F33B627
                                                                                                                                                                                                                                            SHA-512:A5E99FA8AA18E6A7CEB7CFB0C99DC99B606567AD1DDC3BF5AB81D18502F513A9D96D264552F81508317778216B4A4360D87E96AFF302CC7F7FE1DF92C59A6737
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:{"version":9,"engines":[{"id":"google@search.mozilla.orgdefault","_name":"Google","_isAppProvided":true,"_metaData":{}},{"id":"amazondotcom@search.mozilla.orgdefault","_name":"Amazon.com","_isAppProvided":true,"_metaData":{}},{"id":"wikipedia@search.mozilla.orgdefault","_name":"Wikipedia (en)","_isAppProvided":true,"_metaData":{}},{"id":"bing@search.mozilla.orgdefault","_name":"Bing","_isAppProvided":true,"_metaData":{}},{"id":"ddg@search.mozilla.orgdefault","_name":"DuckDuckGo","_isAppProvided":true,"_metaData":{}}],"metaData":{"useSavedOrder":false,"locale":"en-US","region":"default","channel":"release","experiment":"","distroID":"","appDefaultEngineId":"google@search.mozilla.orgdefault"}}

                                                                                                                                                                                                                                            C:\Users\user\Desktop\Cheat Engine.lnk

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 20:44:28 2024, mtime=Sun Oct 13 20:44:38 2024, atime=Fri Sep 30 18:37:02 2022, length=399264, window=hide
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):931
                                                                                                                                                                                                                                            Entropy (8bit):4.5341119647740715
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:8me0N7IBcdtNK9Gt0K9Q3QAh4jdidfbh3ZBm:8mkBcdtN4LEdidN3H
                                                                                                                                                                                                                                            MD5:752745DC3C7636884A69F518A4FDAC02
                                                                                                                                                                                                                                            SHA1:397A20CDFE6E93239FCC41D6DD1DE68662306527
                                                                                                                                                                                                                                            SHA-256:AC18CEF03E373410FBF4D47B52E113B4D5A4915E5FDEB5F2A847BCF94E7D5719
                                                                                                                                                                                                                                            SHA-512:0A9F6762190E2D7524CF0E5B579CCAC8A644370001D7AAC2427B93615C91D7559FFCBC3E84A6ECECA392368A7BB5B4FE8100B47F22ADF67DCEA304C03B4A10FB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:L..................F.... ....No....... ......CV..................................P.O. .:i.....+00.../C:\.....................1.....MY....PROGRA~1..t......O.IMY......B...............J.....g...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....MY....CHEATE~1.5..R......MY..MY......*.........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....n.2.....>U.. .CHEATE~1.EXE..R......MY..MY................................C.h.e.a.t. .E.n.g.i.n.e...e.x.e.......a...............-.......`...........g..U.....C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe..8.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.C.h.e.a.t. .E.n.g.i.n.e...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......965969...........hT..CrF.f4... .'h.V.....,.......hT..CrF.f4... .'h.V.....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                                                                                            C:\Windows\Installer\43e161.msi

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Norton Update Helper, Author: Norton LifeLock, Keywords: Installer, Comments: (c) 2022 Norton LifeLock, Template: Intel;1033, Revision Number: {F1F27AB3-30CC-48BD-90B4-7AA3CF80EB1F}, Create Time/Date: Thu Jun 8 11:50:54 2023, Last Saved Time/Date: Thu Jun 8 11:50:54 2023, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):3.710330368678027
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gPeAETBOSI7Ley3M5ICNsSSAoHx5Pey3M5IC0ioXh:SMBOS8eWMmCNsjeWMmCE
                                                                                                                                                                                                                                            MD5:079852B401B4C83A1982255DCFD795B3
                                                                                                                                                                                                                                            SHA1:4C54232099461DECAD52F45F827503B7C40C8BD0
                                                                                                                                                                                                                                            SHA-256:1F0CBF6DE9A292E02474D32763D54F22108FB15226BD4D2D5B8113C3207A1248
                                                                                                                                                                                                                                            SHA-512:1F07204FCD763FBFDA6D535F9CF4C9971045CBFF3127A2464E46529A8E59FF5269490ED5AB74F71FD957F0ABF3B42D2CF8258F12738D543097EC0DF89E8FFB2C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Installer\43e164.msi

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Norton Update Helper, Author: Norton LifeLock, Keywords: Installer, Comments: (c) 2022 Norton LifeLock, Template: Intel;1033, Revision Number: {F1F27AB3-30CC-48BD-90B4-7AA3CF80EB1F}, Create Time/Date: Thu Jun 8 11:50:54 2023, Last Saved Time/Date: Thu Jun 8 11:50:54 2023, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):3.710330368678027
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:gPeAETBOSI7Ley3M5ICNsSSAoHx5Pey3M5IC0ioXh:SMBOS8eWMmCNsjeWMmCE
                                                                                                                                                                                                                                            MD5:079852B401B4C83A1982255DCFD795B3
                                                                                                                                                                                                                                            SHA1:4C54232099461DECAD52F45F827503B7C40C8BD0
                                                                                                                                                                                                                                            SHA-256:1F0CBF6DE9A292E02474D32763D54F22108FB15226BD4D2D5B8113C3207A1248
                                                                                                                                                                                                                                            SHA-512:1F07204FCD763FBFDA6D535F9CF4C9971045CBFF3127A2464E46529A8E59FF5269490ED5AB74F71FD957F0ABF3B42D2CF8258F12738D543097EC0DF89E8FFB2C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Installer\MSIE307.tmp

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1629
                                                                                                                                                                                                                                            Entropy (8bit):5.659558467744684
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:6EV9KJnuEyYGoYD8SFoeUlInMV9aXuqguEVltWJcXhV9oRXVM:6pGyw2e9GMEPgFk
                                                                                                                                                                                                                                            MD5:D41D658DBBC7A88C1B5DA4BDCBC16C14
                                                                                                                                                                                                                                            SHA1:6609C61C7B82D571F19AFD94372E9E119AEDC983
                                                                                                                                                                                                                                            SHA-256:5F06EA5F2E3DE759EF4A6BE962479F0085B6E1AE6F0FC5F0F480C7A8ACAD78AC
                                                                                                                                                                                                                                            SHA-512:31E58DA719205332E4F05103DD5B52F0A50D8C506DFC94781590613CA13D7ACCBE16BD236B630BFDC10B0A7B63015CDC00EDA6A5AC0CC349F25F4E417C515E76
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:...@IXOS.@.....@..MY.@.....@.....@.....@.....@.....@......&.{469D3039-E8BB-40CB-9989-158443EEA4EB}..Norton Update Helper..NortonBrowserUpdateHelper.msi.@.....@q....@.....@........&.{F1F27AB3-30CC-48BD-90B4-7AA3CF80EB1F}.....@.....@.....@.....@.......@.....@.....@.......@......Norton Update Helper......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{717B7059-A988-492F-AF1B-DCF70BE809AB}-.02:\SOFTWARE\Norton\Browser\Update\MsiStubRun.@.......@.....@.....@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]...@.....@.....@.3..$..@......SOFTWARE\Norton\Browser\Update...@....%...MsiStubRun..#0....RegisterProduct..Registering product..[1]......Please insert the disk: ..required.cab.@.....@......C:\Windows\Installer\43e161.msi.........@....H...C:\Windows\Installer\43e161.msi&.{469D3039-E8BB-40CB-9989-158443EEA4EB}..&.{95

                                                                                                                                                                                                                                            C:\Windows\Installer\SourceHash{469D3039-E8BB-40CB-9989-158443EEA4EB}

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):1.171420622736722
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:JSbX72Fj6QAGiLIlHVRpIh/7777777777777777777777777vDHFiqjBER9JTrlN:JnQI5w0OB49YF
                                                                                                                                                                                                                                            MD5:DF90D334501FEBF71844BDA38CC9529F
                                                                                                                                                                                                                                            SHA1:8D43271F014DF72CD6AACEF634028BA67E3D4993
                                                                                                                                                                                                                                            SHA-256:2DC4A24B6BE47DF1BC255D3C62C046FC23B9A3C60F6B31BDB8B4A398BFDD2111
                                                                                                                                                                                                                                            SHA-512:B367EBF53DE440D35A34C5586E19F5FA5CA75F32393EF86445B6BB36D21C7E8104F6681F840F94150CDCAE5EBC577EB081300721365042707B5DEACC63FC17F6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):1.4542540874205625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:XE8PhNuRc06WX4UnT5iLdaiS7qdoCSIN8lgk:LhN1knTnixk
                                                                                                                                                                                                                                            MD5:12C0A6FD518657B7A2FDEFD68A3F7215
                                                                                                                                                                                                                                            SHA1:06BCCF1DB3020AED93F08D1FDCC6AD4BF6A6F4C0
                                                                                                                                                                                                                                            SHA-256:895B7E54097D7E45E1FE2538D4BF12BD82BD9B3CD09392206F95179257429A07
                                                                                                                                                                                                                                            SHA-512:0D59006902B82BE8D39CC068CB395248C192F54C5D9426D3F4E7DB44CC26BA2DB3A8091A16FCBBC62AACE2DA5A0798720286EC9275057B14818EA7E5F0E20F59
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):432221
                                                                                                                                                                                                                                            Entropy (8bit):5.375173599951625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauw:zTtbmkExhMJCIpErp
                                                                                                                                                                                                                                            MD5:70CBF7E0A6D5ECDE7DE962569CEBFBE6
                                                                                                                                                                                                                                            SHA1:8666B7BF1D008DC0328C46A67EA30ADB84F1EE4B
                                                                                                                                                                                                                                            SHA-256:CEA03AD3D74A2FA1F1EA27CDAD9E7808028B4360231C1B948D09439BDF38E521
                                                                                                                                                                                                                                            SHA-512:48CDFD4FC71AD345D87CD512701745018809DA008F8210F8F735DB38CADF8EA8D4C142FAACAFF6E0C3D29B8F0C17806C36501A5CCC334E0458B7A3461AC2FF0A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\bug_report.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5857608
                                                                                                                                                                                                                                            Entropy (8bit):6.512826474361067
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:hQaHegpcW/vQXw+Z4RBe3xtrlU5JU5OgtR/7I/o:hQaH3QsneLrlU5JU5OgtR/7
                                                                                                                                                                                                                                            MD5:0A10C85A6F8D84B7A8123F2B7A233B49
                                                                                                                                                                                                                                            SHA1:5B2540B05F3F2712D2002EF8DABBEEDE2E581CC2
                                                                                                                                                                                                                                            SHA-256:7DCB3284D637FB01ACA0AA743BAB8AB85DE550C34E1BD91BE164D415C4DFB461
                                                                                                                                                                                                                                            SHA-512:E1AE5587795651FC4950325A112E38D895B7C1282D3C1196565A4CFDF2F65D0974C0F4FDD64226F682098142FBB34AF19C8E41BFE9020AA76246913B04092668
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$...................X......X...U.......................................A.......I...................A......X......X............................}.................Rich....................PE..d.....f.........."....&..<....................@.............................0Z......tY...`......................................... .N.......N.h.....Y.......V.....H6Y..+....Y..p....F.......................F.(.....F.@.............=..............................text...\.<.......<................. ..`.rdata........=.......<.............@..@.data........N.......N.............@....pdata........V.......U.............@..@_RDATA........Y.......X.............@..@.rsrc.........Y.......X.............@..@.reloc...p....Y..r....X.............@..B........................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\config.def

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):549
                                                                                                                                                                                                                                            Entropy (8bit):5.443032726347192
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:2AcW1OPqygANI+xzYN/qb0a3Uk7oMQuROfzZM5KWPoGJ7Ulk:rVAJI+dsqNUk8MQuALqw4ck
                                                                                                                                                                                                                                            MD5:3E9C87EF79AEC6EF3AF203B32B003198
                                                                                                                                                                                                                                            SHA1:82D9DBECBB20FF8160439D9F7D8B87466BCDFBEF
                                                                                                                                                                                                                                            SHA-256:E3E8CBE0A09239F7C977BFC7D283C32E1A8DACD5FADC2F6643724E4E68CB8489
                                                                                                                                                                                                                                            SHA-512:88E65718A1D7B538C14822CBFE1EEA21DD8C102C9B3C0C4B6DFF719EC0F74E3C5C5B83B630F4C8506049B1E793EC2A1F4AED279BC44F904CA8355A0E1C4BFDC5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[ui.offer.actions]..url=https://ipm.avcdn.net/..[ui.offer.welcome]..loadtimer=10000..url=https://ipm.avcdn.net/..[reporting]..disable_checkforupdates=1..report_action_ids=RID_001,RID_002..[common]..config-def-url=https://shepherd.avcdn.net/..report-url=https://analytics.avcdn.net/v4/receive/json/25..[ui]..enable_survey=1..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[Signature]..Signature=ASWSig2A0839A62016BD5ADC618C81BD649502F9846A4D7C56363532F6617DE20034C5FB42DDCB5BE37254EFE49170A8C56892BA45C951678781E3138DF47450818061C8ASWSig2A

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\dump_process.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3515720
                                                                                                                                                                                                                                            Entropy (8bit):6.52433263379008
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:0Klnv2mSZSGmeIqF/F5nY3yaTi2HBbvY8q+p7i8tZ8lArtYtPtXJ+q1cTiyKJ+jX:04nnw1athpWkE4o
                                                                                                                                                                                                                                            MD5:B45C1F4D2DECF7B2F453157EE51B30FE
                                                                                                                                                                                                                                            SHA1:5776E4A828E836D3D902F4D2378003BAC99FD764
                                                                                                                                                                                                                                            SHA-256:EC6AB4F0E8DE9DE8A8C3073BABA01C0BDC941F0B50742C666B121E4CE9E356C4
                                                                                                                                                                                                                                            SHA-512:90801BBFA9AC8FEA2B7CF4D57EC5958C9FD40022E878DE40C050F14092F51D258E88B3B71D72A8639DF2C380B92B86C4A9CC142F416CEB15992A4858B8EDC4AB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...........Ij..Ij..Ij.....Bj......j.....Uj..O.c.Jj..O..[j..O..]j..O..=j..@...Kj.....Hj..Ij..Nj......Jj.....Pj.....@j..Ij..k..#..j..#..Hj..#.a.Hj..Ij..Kj..#..Hj..RichIj..................PE..d.....f.........."....&.T ....................@.............................P6.....T.5...`...........................................+.....d.+.......4..Y....2.....Hz5..+....5.8V....&.......................&.(...p.".@............p .p.....+.@....................text....S ......T ................. ..`.rdata..>....p ......X .............@..@.data...p.... ,..4....,.............@....pdata........2......62.............@..@.didat..P....p4.......3.............@..._RDATA........4.......3.............@..@.rsrc....Y....4..Z....3.............@..@.reloc..8V....5..X..."5.............@..B................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8207176
                                                                                                                                                                                                                                            Entropy (8bit):6.452332377747259
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:HPGafAP4fKA7MTWknT0AufKJKXWu1MTHlFk:vG8AP4fKAoTWknT0AufKJKXWu1MTFu
                                                                                                                                                                                                                                            MD5:B178E9C05511563BDF3A5097D9116197
                                                                                                                                                                                                                                            SHA1:8372B74199C9D2B49C79F2DF61A6734248051A8F
                                                                                                                                                                                                                                            SHA-256:BA37D3942A9C593900B99A86C846013422428366DC42DC3BCA944A6A0FD0A598
                                                                                                                                                                                                                                            SHA-512:15FE06D23A7E1F58E7B7F9038E269B146F7C183A51C7F1C9593DD9E4B1D414748997F1E21FF286383FDDC16D9DEFC5A0908E570C21E7F9E02382709456502631
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......0...ti..ti..ti.....i..r...xi..r...gi..r...fi..r....i.....di.....Ri......vi......|i..}.u.vi.."...ni......i.....wi..ti..yi.."...pi.....ui.....Qi..ti...k......~k......ui......ui..tiq.vi......ui..Richti..................PE..d...L..f.........."....&.&W..H&.......0........@............................. ~.......}...`...........................................n.......n.......|.......x..g..H.}..+....}....(*d......................,d.(...`a[.@............@W.....@.n......................text....$W......&W................. ..`.rdata..:....@W......*W.............@..@.data...`....0o.......o.............@....pdata...g....x..h....x.............@..@.didat..p....`|.......{.............@..._RDATA.......p|.......{.............@..@.rsrc.........|.......{.............@..@.reloc.......}.......|.............@..B................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_product.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):877384
                                                                                                                                                                                                                                            Entropy (8bit):6.588315273201005
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:iFq11j5oI+GqrFgLFkCc0wyBsrTaiJ+fNxNc8pph0lhSMXlipRojKPp+7:iFqxIrFgLdi4NIOh0lhSMXlGal7
                                                                                                                                                                                                                                            MD5:24F0F24A5F2BC395C7E0A9FC0D3E36E1
                                                                                                                                                                                                                                            SHA1:FE30D197FA02509C398DD3889EA29CA9E2C3C8ED
                                                                                                                                                                                                                                            SHA-256:5330BB949B6E9EA2A051EEC0DFB8ED2647705A0F6DABFD1834B9AFADD53BD782
                                                                                                                                                                                                                                            SHA-512:90F423080470B9EBB7E4547CA297FF7D47AB2FFD535D2FC1A6741B38844AF42E53AD932BC908007F52F6AF8EBAF917A4598FEC1B097542300A69D78E98248C8F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.........q@.}...}...}..$....}..$... }.......}.......}.......}.......}..$....}..m....}..m....}.......}.......}..=...l}..5....}...}...}.......}..$....}..$....}...}.........._|.......}.......}...}...}.......}..Rich.}..........PE..d......f.........." ...&...........................................................i.....`A.........................................q......`r............... ...j..H8...+......................................(.......@............................................text...|........................... ..`.rdata..8...........................@..@.data............H...l..............@....pdata...j... ...l..................@..@_RDATA............... ..............@..@.rsrc................"..............@..@.reloc...............(..............@..B................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_product.dll.lzma

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 877384
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):325694
                                                                                                                                                                                                                                            Entropy (8bit):7.999386609731591
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:6144:k0g4sUkokacUJ5ndSyMkurE9Q//fEjdHapIqOW/uxvM:Vg4LkokaVPdBpuIm//9bOcf
                                                                                                                                                                                                                                            MD5:464C4BB3D42B8F59BE8A0DE67B42D773
                                                                                                                                                                                                                                            SHA1:F6E18241BD6E9E0D39D8130BD412D00C89163077
                                                                                                                                                                                                                                            SHA-256:61DE14971A64E484BF11D629B51464C8A73347D0D16041CDA8CCC27472608FC0
                                                                                                                                                                                                                                            SHA-512:4AAA315955529E5BA0992EBEC6557BBB7156D851AAA1CA740DA306AE585F89401489BF33C4A4331B774C88B868AE9B318C7A98D49A9637455ADD7E65E5A587B9
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@.Hc.......&..p.........../D.|....o.e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg.....a.D......BR....O..3.'..jK.0.E............y.t.`..1......."O....le.|.u1.{.....'ea.5......L..%u...;{..e.nK..},..n.P..T.m..i......8_.......+...).X8RD.,.`..]..l.....]..s..[..g....$fJDo...~..YS>z".%..ER?.q6u..5..x2.p&.D.rPR.4..A..f&...<.g..e.......*.........U..'.........66.M..M...s..d03J..y...+....(7..$8.LF.y;;6.....;.R..(x....,.o...~<...0"..u...@O.E6.y.C....j.5*/2?.*.GAz..h.$E..fo.d...1.-.9....H.H.g?.zu?.g......-.5..>..-.6.ka.O..%..w..H.....y.d.#..C.+...'p...F..*:.In``au..3..O.f'..Uf...Mh8r."d...5.....]...y..m#g.;C...c.|N..w ...S...F1...qm.&/.=....Y..x....O..lJ.......?...m`.[.Q.1..7A....o..n.....O2.m...t......-..CJ..=.......|.. .hX..u..W9L..<..UA]V.(j.v.y7y...3.z..v..:...A:8...^.,.d.iUD.{YD.C..N6%P.x.?.(.....+1`..8.@.B.jX..*D[.....#..9..,(.........W........y..[F".0b.a.,N...._...."..k.9..gy.NE.........<}...X.Z......!X.u'.*.........8....K.

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_rvrt.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):50976
                                                                                                                                                                                                                                            Entropy (8bit):6.695978421209108
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:6fMVFuX7Y1C7X+oAiZ8uMX07F9Kx24Zza:WMVFsSC7+K8ua0qm
                                                                                                                                                                                                                                            MD5:97F5D0CAAA1988C95BF38385D2CF260E
                                                                                                                                                                                                                                            SHA1:255099F6E976837A0C3EB43A57599789A6330E85
                                                                                                                                                                                                                                            SHA-256:73EE549578DED906711189EDCEF0EEDBC9DB7CCBD30CF7776BD1F7DD9E034339
                                                                                                                                                                                                                                            SHA-512:AD099C25868C12246ED3D4EE54CEF4DF49D5276A5696CA72EFA64869367E262A57C8FF1FB947AD2F70CAEF1D618849DBAB2EC6161C25758D9F96733A7534B18F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................r.............../......./b............../......Rich............................PE..d....>_e.........."....%.N...(...... ..........@..........................................`.................................................\u..(.......8.......P....x.. O...........l...............................................`.. ............................text...)L.......N.................. ..`.rdata.......`.......R..............@..@.data...............................@....pdata..P............l..............@..@.rsrc...8............r..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\icarus_rvrt.exe.lzma

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 50976
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26032
                                                                                                                                                                                                                                            Entropy (8bit):7.993020359748391
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:dXkqelTjZK0JgHW7tbzdiH2P6AdRo7+lmAo:dEfJJZtwH2PJbuUo
                                                                                                                                                                                                                                            MD5:84B41B6779CD161AA144FCB14B5DB7AE
                                                                                                                                                                                                                                            SHA1:374A045376685DD0E662C8A52DA1B117E719B4F8
                                                                                                                                                                                                                                            SHA-256:57B66C4F8F7DD6B808EACE56846ECCEA4B8CC09568B7DBABC0E59ADD50D739C9
                                                                                                                                                                                                                                            SHA-512:9D501EBB4335ECE860F1806EDFF4C85652962B8B01534C8FAD3904E56AB8058135D7835BDA170CE2D65C392EF39350FF7C0CBDEBC336E3B68136992E634B6B80
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@. ........&..p.........../D.|...G'_..z.-~A..\..*~kHy54......<.....=......6......! o..- 6Y../.e+.Y.1~...~y. .....}..N..H.)G'P0..K..*..?.."...c.|..p.z.m!*..D...P.X..@~..E.B.T....5.7o..Y[C.......1.f..]?.........*......W....z.V.b}.H....h0......>./...w.K..}.o..Tm....V|.2.,f.U.......C@.]..e_.&....3....5NC.:.Tm..A3...:.q'Pj2}.m...1k.s.T....O. .....sq.&PaB...=.F.f.F]..;..'...W....{i8......Ki.u.i..2#..*....L.........F......~..x.W..@.J..X..*.'....0t.g.B....b....Z...@~<...8QZLR..2>_.X....=q...%..r*....oP......B.*&..wjV.........`..-..K.=.&r....*....Mi...q..{!..P.aF........-)D.9...r.iE..3..Q.....}.'....o.VL.3.].fW...,......R....<.P.l./.>.%3...{K>...=0..m.B.....f.=...E.^3...."n{.kw..-./-.,..D.d0..$*...rq$...=...g...._n~...H.....p.I..e..U..(._.5.W..y.7.r.^......?|h..\;$.IW....E..N..$.....>..:..."....v.`Jya.MF.\.>.N...\.....I.m.*e.+.Ut....._...xo.[$.M.Q..V_..X.~.XO..'M;.*.(.@....X.d.{..g...0Lx.C....*......`w.o].....O5.'..Y..........y:}..w.....$.b.{....b..IJ..

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\product-def.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):59456
                                                                                                                                                                                                                                            Entropy (8bit):5.137313540035899
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:vOt4htHPgPSOKOYIZccKOmDPn2dbz11Qs7bgeDb+dyADAmUXfhno31vyFFT3vvW9:4PvgRT
                                                                                                                                                                                                                                            MD5:1C9C29ADA17095A3B5648271E492D2DF
                                                                                                                                                                                                                                            SHA1:9A263933D122C788B31C852400F99B6079E088E8
                                                                                                                                                                                                                                            SHA-256:8F14AB0585DF7475C08574F9A2D53804210948612ACE65DBF12AA6D7A2F3C406
                                                                                                                                                                                                                                            SHA-512:504B6D96F7A245C37C8CDE333B862BF4C86272C8B43EE47F8B0FB86A3B4C3F213CAFEE4644F829F2C5A0234FB1F996ECAF93334367DBE9FEA69F46BBFA6A2FAE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" ?>.<product name="avg-av-vps">..<product-defs>...<config>....<install-folder name="AvVps"/>....<full-name name="AVG Antivirus Vps"/>...</config>..</product-defs>..<group-defs>...<group name="base" mandatory-selected="true">....<action-list op="install">.....<delete-pending-files/>.....<commit-extracted-files>......<important>true</important>.....</commit-extracted-files>.....<expand-vps-version order-base="commit-extracted-files" order="+1">......<important>true</important>.....</expand-vps-version>.....<copy-path order-base="set-property" order="-2">......<post-condition>.......<directory path="%PRODUCT_INST[avg-av]%" exists="true"/>......</post-condition>......<src>%PRODUCT_INST%\*</src>......<dest>%PRODUCT_INST[avg-av]%\defs\%VPS_VERSION%</dest>......<ignore-same-files>true</ignore-same-files>......<move-type>Immediately</move-type>.....</copy-path>.....<copy-path order-base="set-property" order="-2">......<post-condition>.......<directory path="%PRODUCT_INST[avg

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\product-def.xml.lzma

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 59456
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13333
                                                                                                                                                                                                                                            Entropy (8bit):7.98619467588483
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:FCMZmYYxF9mOlnmoPF5XKjLeeOGGi541dcV:FCMZmYYxFFl9j6CetVV
                                                                                                                                                                                                                                            MD5:3FEC82F562587AE2EF76D0952D4FF0E1
                                                                                                                                                                                                                                            SHA1:7D95DDA2CAE1944D6924971A3ACAE52A6F1819B2
                                                                                                                                                                                                                                            SHA-256:6D377AD0BCA2A94387A08D7A03EC80DF8A1B93DFB72601B1293133A541F9AB72
                                                                                                                                                                                                                                            SHA-512:143F05F6D3A5E30A50EEE6116C4D7C4825246FA40CE80C62DB84A19C1FC63FDE817604F509C1678DD8C0F33E90AA66382562635CD45AE505694E671582AF199D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:]..@.@..............f......{3....&.7d..>$....`K...H......8..:_..~...\......>./........%..H.......o...Y....9-.f.P!....p...tC.k.....[...j...7^..1......N8...2....`..D.X.....h.TXhJk]......k...*3...J_..@[...URa.nK'.9W.a..Z.3k/.1e..gF6?.t...~.3e.=........BD....v...G7=..C.zM[B9d^..A...!....3BN3.(`..5T.....ZY&#AM.JA.......lnm.L.`x.......b@.`!...:...ZV.M~.P.%,.p.....Y..X2.oa.\.....}^....>.....7.{R=...3m>......I40Bua......[.q..Fn3j1....V6Wr..i9=P.'..a.y...|...\i&..EP..x.[y....Y5z<...dI..e..D..6.G..5*..%i^y\...O..:.....{...]/..%.[.......I+R...<\So...tPXA......?.T.+H.I.u.....~.cU.yTUq..pO....&=9.....X........RG...?b,....JY....8q.n.f/.<.@.... i;.@D.r/..-.r?.b-...]..g..e...wj.o...Ux"........6.o4...w.b......u.!j&<..`.M..?......._D}.~...@...eM...VJ..6>.....c.........%.q..6N0......!C..A..,o7..;.r.kE..>...aX.w..;p.!*{.6P.H........`o......-.n.|.O.\.=]g^b.'.rU..........2.......6.r&.%......O.U.s.X....vyP.E......F.l.e>J..z.0$...O...R..........r...q.:-(..oB.j.*...

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av-vps\product-info.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5931
                                                                                                                                                                                                                                            Entropy (8bit):5.102305966992679
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:aV028Dn+G28jHzkC0UzxoVN6V36rkYCKaxC+enxRVP8WA+ktM:a228j+G2OzkC0UzxoH6V367CKaxC+exf
                                                                                                                                                                                                                                            MD5:7A8F3D3DEF0F136A04E0DB069073EB5D
                                                                                                                                                                                                                                            SHA1:B2A4B8A09E7DCB8F1E4DC905A1E85A80A1E89D7D
                                                                                                                                                                                                                                            SHA-256:61623C6DBE950AA238AF24B1EE9DA469A7E4A5630ED601E87024AE4E22760B95
                                                                                                                                                                                                                                            SHA-512:8BB08EBF934D78CA09CFA3BF06BF1AEFFC54ED6C547280C9BA00D638B9F148DA7D4EB1319266173DD26ED62484BB07A5F6D6E0ECCACAA23FFBB5673E4D8EC58E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av-vps</name>..<version>24.10.1304.7926</version>..<build-time>1728830226</build-time>..<inner-version>24101304</inner-version>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>4c3eed0441406ddeadf69e99b62da68a216bdb798f8451a55324a02ec4800edc</sha-256>....<timestamp>1728830137</timestamp>....<size>7293256</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>ba37d3942a9c593900b99a86c846013422428366dc42dc3bca944a6a0fd0a598</sha-256>....<timestamp>1728830137</timestamp>....<size>8207176</size>...</file>...<file>....<conditions>.....<o

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\aswOfferTool.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2459976
                                                                                                                                                                                                                                            Entropy (8bit):6.784984125334933
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:YYNggggMXLb/PHdV3SaIOAvAfAAEV1rnFTZT0krlGW+:Y9/fdV3SahAo7ELxTZT0krg
                                                                                                                                                                                                                                            MD5:54158D51F5717DE8D6CA527AF7EDA3F1
                                                                                                                                                                                                                                            SHA1:BF9F0AB713F9936BDCEDB9E3BCB4344343C9A443
                                                                                                                                                                                                                                            SHA-256:93E51218422FFB8D862E9B0FD4F6583CF7B0DA501807563CB59A92C1E758635D
                                                                                                                                                                                                                                            SHA-512:7F429ABCE30B625EDEB94FD11BE351D6BDA97ECC4D040FD17982841A28AD957A2448E922EE227C0EF87CB44F4370C4D2BD5581A9C0C08B7D2E82F4ACB4122B1B
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........C.}y..}y..}y.e.z..}y.e.|.x}y......}y...}..}y...|..}y...z..}y.e.}..}y......}y...}..}y.|.}.+}y..}y..}y.,.}..}y.e.x..}y..}x.p|y...p..}y...y..}y......}y..}...}y...{..}y.Rich.}y.................PE..L...t..f...............&.h........................@...........................%.....p.%...@.........................@.......(........P.............H^%..+....$.,...8...............................x...@............................................text...Jg.......h.................. ..`.rdata...S.......T...l..............@..@.data....m.......H..................@....rsrc.......P......................@..@.reloc..,.....$.......$.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\aswOfferTool.exe.lzma

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 2459976
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):929521
                                                                                                                                                                                                                                            Entropy (8bit):7.999775395145798
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:AROuGbFrR92uE9ZT7rfx21fVR5TDV8re4IwrQHkrAj/OB:Q7yD2P9ZD6tT3pjWYM
                                                                                                                                                                                                                                            MD5:0C57AA86ED56612510D456B1A15940BF
                                                                                                                                                                                                                                            SHA1:2205FD30FF9391F0966FDD2DC2883B447BA69395
                                                                                                                                                                                                                                            SHA-256:A0608823C0534E03A22ED2EF1D37CFA0F79BF61A1E9BC8EAEE06E4BAB4BED859
                                                                                                                                                                                                                                            SHA-512:7AA001D9D0B85398FEF953CDFDCD0DFDC417EDEB6F6BEEFB79E69CE6282D5762F4FED721A8BF6EB5D0D691017B7EF7569338972B275CA264E616832166239408
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@.H.%......&..p.........../D.|..b..6>..p.}#......G...)p{` ..i=`...k.<....G..7.p..C..K.N.........l.....i.'.]....2...z.#8,[.....+.....vLN.i....y..o.O..?........z7......w}....WJ).M..B/..8Q...\7....E+.D.2.\>...7R.{..~..}..o_..T..sUCo@yp...5Md1...lW.N."S.[..1...h,.z....V.[..;..r'.[..h6.~..].o.-..;S.HpM+.....C.N..s.^....c.../#..%N.....!...|...G.//..b..x......g.o..X=...}.s........[Y|i...}%..&t./.V...u_S.S....[.l._..?..........D%e.U..I.a..J%.w...Q..p...iP....^.....8..b.%h..<..:...AeM1$...a1Sg...4>......&5.xy.d!.6]9..G.PT%.>u....b%B+ ..4.,..3]....^.%.D.5..D...'pPjN...;..b...tK..*...'....o.Qo...4Z0o...#....*.g.f^....yR.>.ai;g}.P..`C.....sA.o.....l..3...k.......<.....xQKN.......E:..B....3.?kR-.,_...8....p..t...`.R..P..A.#..w.f~...?...(+.I.....U...c...P.f1..:m.B...6.<..7.K(D....Kx..5,..z../V..c.q.\....tx..m..@..[ .{..(..(0.m$.$...j.x...3......7.4..G.|...~..f..{..X...c.5g..'...V...6......a...qQ..7.........B.`..t>l...J...V..R=@2}=..=.q.8...dc.."5{w.*........

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\bug_report.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5857608
                                                                                                                                                                                                                                            Entropy (8bit):6.512826474361067
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:hQaHegpcW/vQXw+Z4RBe3xtrlU5JU5OgtR/7I/o:hQaH3QsneLrlU5JU5OgtR/7
                                                                                                                                                                                                                                            MD5:0A10C85A6F8D84B7A8123F2B7A233B49
                                                                                                                                                                                                                                            SHA1:5B2540B05F3F2712D2002EF8DABBEEDE2E581CC2
                                                                                                                                                                                                                                            SHA-256:7DCB3284D637FB01ACA0AA743BAB8AB85DE550C34E1BD91BE164D415C4DFB461
                                                                                                                                                                                                                                            SHA-512:E1AE5587795651FC4950325A112E38D895B7C1282D3C1196565A4CFDF2F65D0974C0F4FDD64226F682098142FBB34AF19C8E41BFE9020AA76246913B04092668
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$...................X......X...U.......................................A.......I...................A......X......X............................}.................Rich....................PE..d.....f.........."....&..<....................@.............................0Z......tY...`......................................... .N.......N.h.....Y.......V.....H6Y..+....Y..p....F.......................F.(.....F.@.............=..............................text...\.<.......<................. ..`.rdata........=.......<.............@..@.data........N.......N.............@....pdata........V.......U.............@..@_RDATA........Y.......X.............@..@.rsrc.........Y.......X.............@..@.reloc...p....Y..r....X.............@..B........................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\config.def

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):709
                                                                                                                                                                                                                                            Entropy (8bit):5.416252199173837
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12:2AcW1OPqygANI+xzYN/qb0a3Uk7oMQuROfzXy9G9QV6UaAAOheMWH3zJRN16uQMm:rVAJI+dsqNUk8MQuALC933WDPN8fHGk
                                                                                                                                                                                                                                            MD5:4646674933D76BADF71ADF68D64DF306
                                                                                                                                                                                                                                            SHA1:02E3C3933CD72EE3E15201C8306203EE829D0B80
                                                                                                                                                                                                                                            SHA-256:BA43E79AEB801AE81AE5D9F2E188CBD7BE19D1475EFDDD19AB33CD38DBABB93D
                                                                                                                                                                                                                                            SHA-512:D90C210A85FEC3E87831E299A3A914A3E274EE354EE3311DF1D50EBDD9E4BD5D29CBC1FC1C58167EB7759306129DE84FD908B96C2B8C6E4EEADD922B7A6D062D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[ui.offer.actions]..url=https://ipm.avcdn.net/..[ui.offer.welcome]..loadtimer=10000..url=https://ipm.avcdn.net/..[reporting]..disable_checkforupdates=1..report_action_ids=RID_001,RID_002..[common]..config-def-url=https://shepherd.avcdn.net/..report-url=https://analytics.avcdn.net/v4/receive/json/25..[ui]..enable_survey=1..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[offer.browser.asb]..decision_type=1..download_url=https://cdn-av-download.avgbrowser.com/avg_secure_browser_setup.exe..enable=1..priority=1..ui.offer=welcome..[Signature]..Signature=ASWSig2A60B5F3B40337B573DA04A4B8AC38106B745BF0BC2D8F741348F7E3D8CF7CFA3973D39423EA742327341CEC8C6385A1A570593CC9B960D35CB75E6A6F31CC52F7ASWSig2A

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\config.def.edat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (2186), with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21186
                                                                                                                                                                                                                                            Entropy (8bit):5.687658749059012
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:DFJ7eXHtcV2gFJi0YblA+V4H3p+xHBG1srr7dl913e6c8oaKAX:77e98JiM+4HCBWw/13ev8orAX
                                                                                                                                                                                                                                            MD5:E2C253EC2206D562423751AEE112C1F9
                                                                                                                                                                                                                                            SHA1:0B9E7C0E99093674418A81DE39DFCD87614DAEE0
                                                                                                                                                                                                                                            SHA-256:ECEA99057B475FE1E7B40F93D4D59818E90AE3B948001E5D88DCF908CF241F6A
                                                                                                                                                                                                                                            SHA-512:7CE647553F18291E06595D85CE8F631752AFB2BD62F4F4E910DC0A65F81FB9771D3ABE127F1B0D6A51B53F64C5EC080F1AD72FAAE33068C1AB838AE52A7AF15E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[Settings.UserInterface]..ShellExtensionFileName=0..streaming=0..[WebmailSignature]..GmailEnabled=1..MaxRequestSize=16384..OutlookEnabled=1..YahooEnabled=1..[WebShield.NXRedirect]..Redirect=0..[Features.SwupOpswat]..Licensed=1..[WebShield.WebScanner]..VpsFileRep=1..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=0..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Offers.SecureBrowser]..ShowInIntro=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=24..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicens

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\dump_process.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3515720
                                                                                                                                                                                                                                            Entropy (8bit):6.52433263379008
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:0Klnv2mSZSGmeIqF/F5nY3yaTi2HBbvY8q+p7i8tZ8lArtYtPtXJ+q1cTiyKJ+jX:04nnw1athpWkE4o
                                                                                                                                                                                                                                            MD5:B45C1F4D2DECF7B2F453157EE51B30FE
                                                                                                                                                                                                                                            SHA1:5776E4A828E836D3D902F4D2378003BAC99FD764
                                                                                                                                                                                                                                            SHA-256:EC6AB4F0E8DE9DE8A8C3073BABA01C0BDC941F0B50742C666B121E4CE9E356C4
                                                                                                                                                                                                                                            SHA-512:90801BBFA9AC8FEA2B7CF4D57EC5958C9FD40022E878DE40C050F14092F51D258E88B3B71D72A8639DF2C380B92B86C4A9CC142F416CEB15992A4858B8EDC4AB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...........Ij..Ij..Ij.....Bj......j.....Uj..O.c.Jj..O..[j..O..]j..O..=j..@...Kj.....Hj..Ij..Nj......Jj.....Pj.....@j..Ij..k..#..j..#..Hj..#.a.Hj..Ij..Kj..#..Hj..RichIj..................PE..d.....f.........."....&.T ....................@.............................P6.....T.5...`...........................................+.....d.+.......4..Y....2.....Hz5..+....5.8V....&.......................&.(...p.".@............p .p.....+.@....................text....S ......T ................. ..`.rdata..>....p ......X .............@..@.data...p.... ,..4....,.............@....pdata........2......62.............@..@.didat..P....p4.......3.............@..._RDATA........4.......3.............@..@.rsrc....Y....4..Z....3.............@..@.reloc..8V....5..X..."5.............@..B................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\edition.edat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Jn:J
                                                                                                                                                                                                                                            MD5:9BF31C7FF062936A96D3C8BD1F8F2FF3
                                                                                                                                                                                                                                            SHA1:F1ABD670358E036C31296E66B3B66C382AC00812
                                                                                                                                                                                                                                            SHA-256:E629FA6598D732768F7C726B4B621285F9C3B85303900AA912017DB7617D8BDB
                                                                                                                                                                                                                                            SHA-512:9A6398CFFC55ADE35B39F1E41CF46C7C491744961853FF9571D09ABB55A78976F72C34CD7A8787674EFA1C226EAA2494DBD0A133169C9E4E2369A7D2D02DE31A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:15

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8207176
                                                                                                                                                                                                                                            Entropy (8bit):6.452332377747259
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:HPGafAP4fKA7MTWknT0AufKJKXWu1MTHlFk:vG8AP4fKAoTWknT0AufKJKXWu1MTFu
                                                                                                                                                                                                                                            MD5:B178E9C05511563BDF3A5097D9116197
                                                                                                                                                                                                                                            SHA1:8372B74199C9D2B49C79F2DF61A6734248051A8F
                                                                                                                                                                                                                                            SHA-256:BA37D3942A9C593900B99A86C846013422428366DC42DC3BCA944A6A0FD0A598
                                                                                                                                                                                                                                            SHA-512:15FE06D23A7E1F58E7B7F9038E269B146F7C183A51C7F1C9593DD9E4B1D414748997F1E21FF286383FDDC16D9DEFC5A0908E570C21E7F9E02382709456502631
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......0...ti..ti..ti.....i..r...xi..r...gi..r...fi..r....i.....di.....Ri......vi......|i..}.u.vi.."...ni......i.....wi..ti..yi.."...pi.....ui.....Qi..ti...k......~k......ui......ui..tiq.vi......ui..Richti..................PE..d...L..f.........."....&.&W..H&.......0........@............................. ~.......}...`...........................................n.......n.......|.......x..g..H.}..+....}....(*d......................,d.(...`a[.@............@W.....@.n......................text....$W......&W................. ..`.rdata..:....@W......*W.............@..@.data...`....0o.......o.............@....pdata...g....x..h....x.............@..@.didat..p....`|.......{.............@..._RDATA.......p|.......{.............@..@.rsrc.........|.......{.............@..@.reloc.......}.......|.............@..B................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_product.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6277960
                                                                                                                                                                                                                                            Entropy (8bit):6.488087009634578
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:E9d6SjG3r+9oMdIiBCdaGh13D9FiqHPP:E9dbjG3SkNaGvBFF3
                                                                                                                                                                                                                                            MD5:6190685F8F4A51D7A3507B4C0CF799F0
                                                                                                                                                                                                                                            SHA1:8ED784BD9CBB0297C51DB2FA0174EF1E4B8C48A6
                                                                                                                                                                                                                                            SHA-256:38BE6477DD9F4865A65808721CEE795151246340FC4D514DAE40762DA71AE8AA
                                                                                                                                                                                                                                            SHA-512:1A81F9939FD9C3D2A60E53C852783D54E5CA10582F5CF5C459CDBBA312E83B8329BA6BE848E029D98303043A006D8D7B77C1659CF0724D2DAD0B5B0DB83BE98F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$...........].~.].~.].~...}.S.~...{...~.[!..Q.~.[!z.O.~.[!{./.~.[!}.K.~.T..._.~...z.A.~...z..~...{.Y.~...x.\.~...{.v.~...z.^.~...}._.~...z.U.~.....p.~.].....~...z.\.~...{.F.~.].~.S.~...z.x.~.7!w...~.7!~.\.~.7!..\.~.]...\.~.7!|.\.~.Rich].~.................PE..d......f.........." ...&..>..n!......=$.......................................`......_`...`A..........................................S.....|.S.h....._.......].....H._..+....`.......J.......................J.(...`.J.@.............>..............................text.....>.......>................. ..`.rdata........>.......>.............@..@.data...h6....S.......S.............@....pdata........]......2\.............@..@.sdata........_.......^.............@..._RDATA........_......._.............@..@.rsrc........._......._.............@..@.reloc........`......._.............@..B........................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_product.dll.lzma

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 6277960
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1773925
                                                                                                                                                                                                                                            Entropy (8bit):7.999882842985942
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:b52sVmaAE/N7lRu3tf1zFo0wgnwk+EE6o2o457mkLysqpJZcMHM17mfSK5QNZsEc:12s8AF7lQDzFFwIwTE/boI+KMH5mNjc
                                                                                                                                                                                                                                            MD5:B2B7DB3398EC7D35AD95B4A8BE4DA787
                                                                                                                                                                                                                                            SHA1:A1D900D12A3C08E96166B11F4A14C83DEA9B6E62
                                                                                                                                                                                                                                            SHA-256:39AE9C60F419854139BFC33D43843B03AED41A4D8EE842C804C2683FA6065C37
                                                                                                                                                                                                                                            SHA-512:2764E6750B0EEAB93085E91271A1E4EF0DB2E1B8873784B4B7E6B11441A7B02FC628478B7FEC6DEAA834351CFF9183A8E585E69A78AB1DB177D59DED708C259F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@.H._......&..p.........../D.|....e.I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f}K..?.1J2a_.O.....A..*...T.[.k......}.M.-..'V.......;.G...t>.DX#.u....:[..3"......7,.KrY..ZNX{c.Z...3..-...'.u.-..s....T.^.....0....]...K...P.0.....w......5...P....k...S.IK..f.2...._.W.i..VL.m./a....HzZ..W.v0.N.M.5.{a.....V..D..S.....L4..>s....NY.;..7...6...N.:....!..g[.^k.....l...E:....M..(.....v.2.....K.....\.ix. ..*.A."...w...b+..e...ZG..b......6..@....'@@.....[C..[..i.j..L>N.0/....P.t.ic..#y'a.Z8...x.@..Z..o2..p.i+...[..`..m.Z..2....M.S...D.^....'.....C".......*......=H....M..y..k.F.-....-.8Kj...)..E.S.{.".5>.={z.E.s'#U..@...rn..Ub..<.TP...|"..kYPY..G2v..........2I........;........0/-.....*...I.b....me.S7R.x.ogd......Z.)..7OS.Z..k.mvi....D9@@.Z.Ap...+.j(=...`.{Rq...ZT.9f.1../..p7.<.O..k.R..=..).....9S.E.Y.i.%......a...e.s.<..GS...\P.V&DM.5N.jn..g.G.Y>y.D..N4h....R....Q.f}]..j.z..#'vF...A.~i.M.rcr..9.....s.$L.......%........(..}

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_rvrt.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):50976
                                                                                                                                                                                                                                            Entropy (8bit):6.695978421209108
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:6fMVFuX7Y1C7X+oAiZ8uMX07F9Kx24Zza:WMVFsSC7+K8ua0qm
                                                                                                                                                                                                                                            MD5:97F5D0CAAA1988C95BF38385D2CF260E
                                                                                                                                                                                                                                            SHA1:255099F6E976837A0C3EB43A57599789A6330E85
                                                                                                                                                                                                                                            SHA-256:73EE549578DED906711189EDCEF0EEDBC9DB7CCBD30CF7776BD1F7DD9E034339
                                                                                                                                                                                                                                            SHA-512:AD099C25868C12246ED3D4EE54CEF4DF49D5276A5696CA72EFA64869367E262A57C8FF1FB947AD2F70CAEF1D618849DBAB2EC6161C25758D9F96733A7534B18F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................r.............../......./b............../......Rich............................PE..d....>_e.........."....%.N...(...... ..........@..........................................`.................................................\u..(.......8.......P....x.. O...........l...............................................`.. ............................text...)L.......N.................. ..`.rdata.......`.......R..............@..@.data...............................@....pdata..P............l..............@..@.rsrc...8............r..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_rvrt.exe.lzma

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 50976
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26032
                                                                                                                                                                                                                                            Entropy (8bit):7.993020359748391
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:768:dXkqelTjZK0JgHW7tbzdiH2P6AdRo7+lmAo:dEfJJZtwH2PJbuUo
                                                                                                                                                                                                                                            MD5:84B41B6779CD161AA144FCB14B5DB7AE
                                                                                                                                                                                                                                            SHA1:374A045376685DD0E662C8A52DA1B117E719B4F8
                                                                                                                                                                                                                                            SHA-256:57B66C4F8F7DD6B808EACE56846ECCEA4B8CC09568B7DBABC0E59ADD50D739C9
                                                                                                                                                                                                                                            SHA-512:9D501EBB4335ECE860F1806EDFF4C85652962B8B01534C8FAD3904E56AB8058135D7835BDA170CE2D65C392EF39350FF7C0CBDEBC336E3B68136992E634B6B80
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@. ........&..p.........../D.|...G'_..z.-~A..\..*~kHy54......<.....=......6......! o..- 6Y../.e+.Y.1~...~y. .....}..N..H.)G'P0..K..*..?.."...c.|..p.z.m!*..D...P.X..@~..E.B.T....5.7o..Y[C.......1.f..]?.........*......W....z.V.b}.H....h0......>./...w.K..}.o..Tm....V|.2.,f.U.......C@.]..e_.&....3....5NC.:.Tm..A3...:.q'Pj2}.m...1k.s.T....O. .....sq.&PaB...=.F.f.F]..;..'...W....{i8......Ki.u.i..2#..*....L.........F......~..x.W..@.J..X..*.'....0t.g.B....b....Z...@~<...8QZLR..2>_.X....=q...%..r*....oP......B.*&..wjV.........`..-..K.=.&r....*....Mi...q..{!..P.aF........-)D.9...r.iE..3..Q.....}.'....o.VL.3.].fW...,......R....<.P.l./.>.%3...{K>...=0..m.B.....f.=...E.^3...."n{.kw..-./-.,..D.d0..$*...rq$...=...g...._n~...H.....p.I..e..U..(._.5.W..y.7.r.^......?|h..\;$.IW....E..N..$.....>..:..."....v.`Jya.MF.\.>.N...\.....I.m.*e.+.Ut....._...xo.[$.M.Q..V_..X.~.XO..'M;.*.(.@....X.d.{..g...0Lx.C....*......`w.o].....O5.'..Y..........y:}..w.....$.b.{....b..IJ..

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\icarus_ui.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12355400
                                                                                                                                                                                                                                            Entropy (8bit):6.575346743980645
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:DPkuwtZB9sRaWX1/gEf+7x3xVUJrqNuG:DcuwtWX1/1mth6JrqNR
                                                                                                                                                                                                                                            MD5:6B2077C64EE0FF998E2FBC1D9E3331C1
                                                                                                                                                                                                                                            SHA1:E10DB878BFC6653E571A752C491410757B0AAD4D
                                                                                                                                                                                                                                            SHA-256:C686CDD74A82DFFD852BFE5B739BD2022835B25941D394935B0EF0EC18453F8E
                                                                                                                                                                                                                                            SHA-512:F1D65E3BF0F4E83D2A61F40E842AB752C137FA872537BC93E091F05373449748999C072EA0CBFB6C353CCB6EADF9697DB7237E89FDBDA018733C0AA8B106462B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........L.zj..zj..zj.R.i..zj.R.o.Xzj......zj...n..zj...o..zj...i..zj.R.n..zj...n.|zj...o.mzj......zj.C.n..zj..zj..zj...o..zj...i..zj...n..zj.R.k..zj..zk."yj...c..{j...j..zj......zj..z...zj...h..zj.Rich.zj.........PE..d.....f.........."....&.$...va......k.........@.............................@......mg....`..........................................R.......S.......`.......0..h...H\...+...p..................................(...@...@............@...............................text....".......$.................. ..`.rdata...j%..@...l%..(..............@..@.data... r4.........................@....pdata..h....0.......h..............@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\product-def.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1326725
                                                                                                                                                                                                                                            Entropy (8bit):5.393225248894363
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:aqiBrS3XIq+W20lihJYsbYmSkG8uDOVB9EjcJ44B5T+kqDBqCsq:aqiBrS2MihJbbpSkG8uDOVB9TRfZqFq6
                                                                                                                                                                                                                                            MD5:64E9654EDBF448A82E04DD5FC0587FF8
                                                                                                                                                                                                                                            SHA1:8326E5931263B5A1A4E032326E06C7764A0D748E
                                                                                                                                                                                                                                            SHA-256:E27CE9139C203B6FB8EA8B8D82D50EDEB2466DF76377DB241AB31F47AF561134
                                                                                                                                                                                                                                            SHA-512:B6065191A2B173DF182DC9B4159E3B6BB715659D353AECF98702A3F0728553E5D193E8FEA7FA8236994C004D89D452F4DDD15552E868F0DB2A7785B2F0162B6F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\product-info.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9649
                                                                                                                                                                                                                                            Entropy (8bit):5.273780607164147
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:+2RjUS0VmNETL/ZmSStpUzLoHGVlg1sKYxCwexPK8AEMRzyzW2rsq:++vKmNYAtkvDleVzaeWcT
                                                                                                                                                                                                                                            MD5:3695F2E718958E15D63A8CB2C273608B
                                                                                                                                                                                                                                            SHA1:D1D7BA90C3DF2BAFE396F59429F19FAC8AF16211
                                                                                                                                                                                                                                            SHA-256:CC2CA580DA5B640C05276FFE2E08E8B769BF6B8D0158A93023BBCC031AF74749
                                                                                                                                                                                                                                            SHA-512:1F1DAC317196B320A3060441579318525C4C9B0E57B203E81A7FC9D651EF71FCA79DF09CBB8F330DE04F88D1EB4B78EF08DE47CAC5074EE7249901E6BEFC6E84
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>24.9.9452.2135</version>..<build-time>1726655619</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>4c3eed0441406ddeadf69e99b62da68a216bdb798f8451a55324a02ec4800edc</sha-256>....<timestamp>1726655544</timestamp>....<size>7293256</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>ba37d3942a9c593900b99a86c846013422428366dc42dc3bca944a6a0fd0a598</sha-256>....<timestamp>1726655545</timestamp>....<size>8207176</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<name

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\avg-av\setupui.cont

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            File Type:XZ compressed data, checksum CRC32
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):391044
                                                                                                                                                                                                                                            Entropy (8bit):7.99950093995657
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:6144:MFvsbMYNT/9s832RY3TRz0UE7clnj5QJ0WkkC4DEvWugdib:8sbMYNT/dymRz0MNlqgv5Aib
                                                                                                                                                                                                                                            MD5:326F541D5CF5F3DBBFC69A4FBD409389
                                                                                                                                                                                                                                            SHA1:FD59C5062E80CFD58E5F4DFE1FDF129AFD2DD145
                                                                                                                                                                                                                                            SHA-256:3A9BC34B6B2C36180DCA72E2D1C706269D1501EBD9B2C37E39E9E8D5F7D54E5C
                                                                                                                                                                                                                                            SHA-512:A88DA5AB25041442ADED224503864CBD4D370A2866D93E563F2686D590C683462F99FA37BA595C1260EE46FFCC5F35AF51F1423E77EFF1A36F1CC2857D7A3F6A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:.7zXZ...i".6..!.....F.;...3.M].0...?..Lm.K%. .6.X.....L.@#........EG.6... ...9..L..5.$.e....=.8......],P,....V..E. }?[..u$...{.vv.<.nd....<.....\...A...VmC...@...-...j....J*....b.T..0.G.H.9"~..W).S......;".C..z.%k...7;i.!)7.;I.. a...T..d.%.#.F....$...(..a.-..gR...L7.#.:..1..L...Y.m..I.a....2.]..s,~.{4..e....>$..6....T.@.....k.....z.$'....d.)9.w:...y...(9.4.k.;.d..(.`d\V.O...I.%...'...G....D".wD'..,..........i]...i...`;."......X..g....a..H:....k......$..w.4...g....:Q].....!..n..6....L.......~....^...+......z.W.[/<e8...J~y..y".._.Z.eD..=+..@ 7u..c.D......S.....a>.&. ..y...YHNK..Od ...E.DZ.c.....Hb...t...H..H1-.z..(..s..Y..N...j..a..3.s........1...F...o.+..GW.3.g.......7.^.....f..D.-='...(.N.R.. U..B....F_...t9.N...m;"..[....4k.U..)b...a..Ol..C.V.yJ....R..l.'.........N.....t......cW.[......IK'.f......n.w.0...0. .]...=..'`.v....%\.F;..Om4..v.Y.-z...]..B.z..xbV1..<...n...........KVf]..}2.&.........v..F.Z.37.Gs.p}.l.`.e.r...`Y..o.....$m

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\511684e9-5057-4028-b2fd-11934b8e0bb7

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 3515720
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1022946
                                                                                                                                                                                                                                            Entropy (8bit):7.999832489557521
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:24576:XsWytpZvN32+/CBICJaJDfdYczabn+27D4Dhl:8WoZvNGvICJaJDfCccH8z
                                                                                                                                                                                                                                            MD5:85E3413083D6499D3F3732BB3795FB73
                                                                                                                                                                                                                                            SHA1:B70EB0A2D49A6CE199F1B937DF367D07D731A1E8
                                                                                                                                                                                                                                            SHA-256:ADBFBDBF2D217CFF9877F2CB916B6FA6DE1B2110C752DB26C04C5E5ABBDAA42B
                                                                                                                                                                                                                                            SHA-512:3688F27CCD2A460E1285722AB2FD24BA619312707F0ED6D8B39DEFBBCF19F77139987912D72729281A429D624E9C387D86993DB4A5F94CFB213887064B302898
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@.H.5......&..p.........../D.|..b..6>..p.}#......G...)p{` ..i=`...k.<....G..7.p..C..K.N.......j..u-.r...........u.t..h.........x..B.......<.B..y...A..F.=.i.R.W..3gK.6.X........3...YM.?.k.W.H...\<.$..g.9r+..j.8...b.L..wM...y.R!u...e.1...M.e.|}7.b>.p5zH..s.b...5....g.c..:......r...<}..+}(g..UcD.Z...g.<........i......h.QY.^...`.......oV.6..R.e;s.(dA!.2.........;.}..`>%t.F..S.I..!5.$.....\.G.x.P...t..n.)...F..7..r..:Z./.h......2..k...g..{......U....8....?8......-.f.y/..w.%...@...q .O..H..'..A..k=r........Md..x'.M@.K.:h<....d..~P....&R.'.....x..G...U=.yF..d.L7...p..Z9..L...K.g..I.........D...^m.............mo......X..K.XX..D.......9.C.p...q.{.7.1.3l{59.^bC.._...v&..........U.}J./{...8.#D..B.}1I..).20;'...#.R...O.$.]b..Q....3.*U.!.....:..&?$.6Jq..7.e........r).Z.j..E:^.j....w.,.v..Z>.T.D7......o..PGJ<..#.D.".g0o._..P......&e....91!.....j....`.;...:dz.j2T.3.|.n.;H......uS...]m.J8.,.4?<.z....j.aX.....jK.Mu<....?n..(..y.7."..?p....Nne..cn..=.

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\6f9be9cc-e43e-4a27-bf97-77fab14f54a1

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 12355400
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4008359
                                                                                                                                                                                                                                            Entropy (8bit):7.999957357266098
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:98304:9K18NVsz2miXmkkTuNioFVFdU2QltV/q+v4ncPa:9EWVsiVzuuNRO2qR0nga
                                                                                                                                                                                                                                            MD5:3AEBD5448E89CD33C0D85D96A2E973B6
                                                                                                                                                                                                                                            SHA1:AE66E0D4F6B64D81540FE2CBB7D358F690FB7334
                                                                                                                                                                                                                                            SHA-256:C824E0063F7A15D84A72EC2017792A86D34F110E15FB50DCC596AA2AF8B0B20E
                                                                                                                                                                                                                                            SHA-512:FB65C43F6894BE7D616AA3E17E78E7A7165F2E88093E7BFFC2D0388267F5249A8F9F5ABF3EA4EFB69A32903F8272CBE892981B72404E3959A0EADE8451F928EE
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]....H........&..p.........../D.|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg.@....R=.V..](..:l.N....u..<..)h.....4.a.....<G=....J..._..Q%........c.I.....6.H..*.._..z.c.m....,..._C.../9...zl......v..W..%cJ.>.m.!b...+C<.c2...z.5Iy.....tr.I.L.P.....^....VG..+.6(..1.B...`.......C9C.L.....6.W.RH>..!....J..). .\N.i.yW6*.~8.r..%X...k#_...:.)P......M....sR}...|.(n.x..Ok|.i...<.I>P..5k_-.0i...E....k],.."/{b+dK...~u.n.#...8...t;:!....A.s....2.?$.iJ.)...,.,l1JxxtB..iMM...].HT...8..V.9..l..F....y..g..|....._C.%@.R.5.t6...3#"JF._... P...l.....w.......=.A......w.-W#.N'I1Z.5..ej..(..a.....P...~../{.....'.p..yL1ag.q..?.....^.G.o.#.l.4O.....g...i.,O...}e<..j-..i#.N.........}."..V.A.....p..d 8......;E6...'...=.Ht..{&>h...^.V...7..I.....]..}......VO.6.......;.Qg.9....g.i.."f.TL.....s..J ./..T..-.~.1..^..KJ$........C..I.....r.B.r..'...;..."..BwV...G.....)..\...1.u..#t. K..&..j... .G..zg.s....#;m..2..g..#.F..f...1/..,3.[s'. ...vt.a7.L.]lX.t../..[`pi.....

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\9dbb4156-c638-4892-8fca-7492b7a2836c

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 1326725
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):144190
                                                                                                                                                                                                                                            Entropy (8bit):7.99867427042036
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:3072:CkRHTb7lGFZtoSbkhleRl8a2nWELFq2nNU3D+E2smC4KNU8j6CFgNDn:CkXUFDoB6l8a2nSEtE2eU8jV0n
                                                                                                                                                                                                                                            MD5:F8E0FC53E5D9A054DADB630BC3074B59
                                                                                                                                                                                                                                            SHA1:4CBEB145DEDE41F77778CCEC9CF9131E520577F0
                                                                                                                                                                                                                                            SHA-256:FD629B541B7DEEADADE2E283F1C5A36E26745DD6BE3E74039950B818B8FF5154
                                                                                                                                                                                                                                            SHA-512:DD14433525242507930223966D23DEB2A159140E8AC9560206D3DBD29A0428E38AE97523477AA7C8A2434BBB99E6D4263C17ECEC69F63712ABF3EB989F2018C1
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@..>.............f......{3....&.7d..>$....`K...H.......4...^.a.)....0C:.6..n.f.c...j...$Px...........X.PMf$5.B....O..DN....[.d..s..s..M..:B..(.N..L.?7=~Rg.[...N!."..8......1uW.#....;u<Q..MC..Kl.#.9!U.3N..N...^....Gp..a.@....-.m..Q...c.6.....]..vK..I..(.<..s.1h.r..)y.]!J9%...*/.(]X...%."....Y.,.J.......Z..T,....u1.&......n..&.!E$Dn<..;."....@..90H$Jk4..{i%.@^...q;.%.t!......Md..fJp) m.0..>3......hs...Y.4..<...Q8.$.@.n...u..N..X..ia.f..o.."....b<...^X...z.U;..[..[....A.`.W.0.X..l...v.GfM.9..y..q... $.....4E..Xd..[l.>..R...z../KjC*d..9J...!.O..U.^.l..].S).zLS.[90....O."0...kX[$V!...b{...1&.*@a{....|.Bg.....d0K.KGS.....r.h.]m.9..}.>Y.Ha..Sh.\.UgmX.......Hm.!8.?..k..r)..z.M........bc0:...N9?Qf.w78.....j.C y...;...V8.8..'....HE.Ur..A.,.4.....k.:'Vm.M.J.`..V....*.`.U#...\.8.G.`:......7...P."~.T....|...n......qsm.|..a....L......M580...............e...c1.9.8B.i<..@..~...5..&......kl@..<%8./H..R.),.\.G....0...G....NQ.~O....T.s.p...w.....KjX,

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\a1aa0ea5-4861-4bb0-96d1-862772d227e7

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 8207176
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2479319
                                                                                                                                                                                                                                            Entropy (8bit):7.9999448249710525
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:49152:rVLBHGpV9jeCaueYk6ntmAYHV+oYbp4ztT2fo8kUuu3sO:rV9HWVgCauek0HV+V6tT2EUu3O
                                                                                                                                                                                                                                            MD5:B207DEAB4C93FC1F11DA1C6F7F082333
                                                                                                                                                                                                                                            SHA1:006C3189018FC1D13CBAEB504F6D2B691E80941E
                                                                                                                                                                                                                                            SHA-256:4D05A86165067BF5527600517378682C5B2D5861A8E7516330803438701613B2
                                                                                                                                                                                                                                            SHA-512:06D07F6D25A59EB89205D26C6F7EDB09B861CEC159B34A9EDB5F0EDC5DB35DAE4830E0EB93A4050E11E8CF368709E6943D7F06833539FC99D8D8FD77BEB00DB3
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@.H;}......&..p.........../D.|......I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f~.*8.A.#C..._c+....j........R...N%x.Bb...F.t#....Ri6...\....i.9Ow..%\&Q..l..c...t9>....E].Az...............3....j).&.$..<.8..W..2.|g.........iQ.S.=.o&9|..r.).!c.tfGXNw'f{.4m....*l$H...2.2..{..P. .<>..8j.B[p.m..!Z..w.}5.F2.L..............yP2..rU6...u...l..Y.Q..=.....(...i8..dJT.b..+.yo.R..7..........6.7......K...qyh..j.c.B.........t.M....R.@V...#2z.,...`Y..&.Gm...q.k.q.*Y6...a.C...pf.2...eO.....?..W.v.....~g.8....PVU.......>d.%u.O.)4.0....O."+Y.;...\.(I.T.]..Q.....Qf;KP..6]$Za@..cL..t...*.j.......<IE.QL.....Z..E.ohQ..._.<M..\q......s...:.~.t;....s.Z./.o..i.aH.V..^:z..$...}">Q..Z........G8>.k$y...}....H.C%...4|..-..v~@C.A...K.~.....]..fw.....y....C..b........u..|Y.@......L.9..J.P!..j.;..d.g..M....[.@X@.2.[...^.*.v..P".{. .....d...*W.A..dJh.|.&..c......7BM.....2|5.*..e^wI.:....b..>=U^..!q......0Q..c..+....Xo~.({C!2x.w9....s....^...W..W...G.A....[.\[.

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\bug_report.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5857608
                                                                                                                                                                                                                                            Entropy (8bit):6.512826474361067
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:hQaHegpcW/vQXw+Z4RBe3xtrlU5JU5OgtR/7I/o:hQaH3QsneLrlU5JU5OgtR/7
                                                                                                                                                                                                                                            MD5:0A10C85A6F8D84B7A8123F2B7A233B49
                                                                                                                                                                                                                                            SHA1:5B2540B05F3F2712D2002EF8DABBEEDE2E581CC2
                                                                                                                                                                                                                                            SHA-256:7DCB3284D637FB01ACA0AA743BAB8AB85DE550C34E1BD91BE164D415C4DFB461
                                                                                                                                                                                                                                            SHA-512:E1AE5587795651FC4950325A112E38D895B7C1282D3C1196565A4CFDF2F65D0974C0F4FDD64226F682098142FBB34AF19C8E41BFE9020AA76246913B04092668
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$...................X......X...U.......................................A.......I...................A......X......X............................}.................Rich....................PE..d.....f.........."....&..<....................@.............................0Z......tY...`......................................... .N.......N.h.....Y.......V.....H6Y..+....Y..p....F.......................F.(.....F.@.............=..............................text...\.<.......<................. ..`.rdata........=.......<.............@..@.data........N.......N.............@....pdata........V.......U.............@..@_RDATA........Y.......X.............@..@.rsrc.........Y.......X.............@..@.reloc...p....Y..r....X.............@..B........................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\d7d319e6-a995-47bb-92b5-c7b1f08cfa98

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 391044
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):396500
                                                                                                                                                                                                                                            Entropy (8bit):7.99951440013991
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:6144:uAimsZt3Hkz141mGgNdljuVhgIDfwXARmfAFmaLXNpco3YPHOFQR3V9SUc:8TREh41mGgNm6IjwXAbBrPoHOFk3VAD
                                                                                                                                                                                                                                            MD5:B27AD3983349E5E9CCD780652ECB27B9
                                                                                                                                                                                                                                            SHA1:A2ADC919D05F512E4D0C84B8C2C81BEC821BED1A
                                                                                                                                                                                                                                            SHA-256:535A50DE59F01482A9404F40C126053DF0A36C974F7ECEF4A7DBDA65AFDF4996
                                                                                                                                                                                                                                            SHA-512:34DDAEEFAE6FF655306306CC8D3AED6D4F1E0877F1ACA3C5686EFC0EA59F2EC20F658DA714471DC7DCA20DE1C29BC9E4223EA38A1241FC113C689D3DE3721402
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@..........~..E..8... .rZ.~0.eg6.....~P!...D.....V.em...znt.7.{*.W3.w>..5....-...r....>.*o....I......P..fU.......e=N+.?.....l..L.J.[=F}}...xFa.F...v=.))......._VI7T.o.g.p... d........J.."2>.U_......m.Ko.HZ.........<.X.S.,.....<....jZ.u.I......s6.....g.t..#.. .*.&4c/...m.$.m.MY..d%.d.Te.,....(%h.W...;.s5.=.......~!...E.....}[..X......R.....x:....#Z.s..)..).a.nTW..p..r..?<.I.p .M......\S"....+...|....i6......7...j.v..u`2o,|.Ab]+p..H....fp..)9,{K..nZT...g..)...;.6....$....UB...l$..bqK.$..:........]D..-I.....d...[E .c.a..s.w`."..I.t7.gk..df8.?.3..Rk.02S.raw..M.K.i]...<...rYmC:.\h.D.IZ...X..g........Vd.D..g>......a..3.%}.fNa..R..L.[........t.4....-..H...^...`.w.d{x...h....I....0..m!...5.4.......L........n..$>U........c...Z..i..{v3....H...2y..jWH'].c.c.1.7...Yp~.7......".VOfE..c7.ee.K).B.AQ.ULd'.KK9){..R...<..`q.o..i.....U..5.....R.....cMp....:o...w...,g.../j...W. -....AE.T'..$..8.x#..I@Q.4.'.4.6.......".y>...r#...1..#=1.c..s..P.M.8s...>.D.Ym

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\dump_process.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):3515720
                                                                                                                                                                                                                                            Entropy (8bit):6.52433263379008
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:0Klnv2mSZSGmeIqF/F5nY3yaTi2HBbvY8q+p7i8tZ8lArtYtPtXJ+q1cTiyKJ+jX:04nnw1athpWkE4o
                                                                                                                                                                                                                                            MD5:B45C1F4D2DECF7B2F453157EE51B30FE
                                                                                                                                                                                                                                            SHA1:5776E4A828E836D3D902F4D2378003BAC99FD764
                                                                                                                                                                                                                                            SHA-256:EC6AB4F0E8DE9DE8A8C3073BABA01C0BDC941F0B50742C666B121E4CE9E356C4
                                                                                                                                                                                                                                            SHA-512:90801BBFA9AC8FEA2B7CF4D57EC5958C9FD40022E878DE40C050F14092F51D258E88B3B71D72A8639DF2C380B92B86C4A9CC142F416CEB15992A4858B8EDC4AB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...........Ij..Ij..Ij.....Bj......j.....Uj..O.c.Jj..O..[j..O..]j..O..=j..@...Kj.....Hj..Ij..Nj......Jj.....Pj.....@j..Ij..k..#..j..#..Hj..#.a.Hj..Ij..Kj..#..Hj..RichIj..................PE..d.....f.........."....&.T ....................@.............................P6.....T.5...`...........................................+.....d.+.......4..Y....2.....Hz5..+....5.8V....&.......................&.(...p.".@............p .p.....+.@....................text....S ......T ................. ..`.rdata..>....p ......X .............@..@.data...p.... ,..4....,.............@....pdata........2......62.............@..@.didat..P....p4.......3.............@..._RDATA........4.......3.............@..@.rsrc....Y....4..Z....3.............@..@.reloc..8V....5..X..."5.............@..B................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\e3526f6e-1aba-420e-bce6-afd5a4f27b9c

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 5857608
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1816156
                                                                                                                                                                                                                                            Entropy (8bit):7.999888745483468
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:49152:rZlBKYqX0GYNddibSxXdzIO9lHmlUetirBO/0cS/kY:rZvxqXaTnNzFKUewdg0b/kY
                                                                                                                                                                                                                                            MD5:65A5BE66B625A435F077526F5F3638FB
                                                                                                                                                                                                                                            SHA1:EC2C6B221E45576BBE9128269DA76456541ABFC9
                                                                                                                                                                                                                                            SHA-256:13DA927C03C7351B42FB40845D6F0C92865AC30746EDCDCC629CB26F43DCD9A5
                                                                                                                                                                                                                                            SHA-512:D1FE28A9F6174CF269610D9639BC898B3BD0FA4DF86F5C1B9FB317C6B4FEB996A8CDF3C6A75398A17930BDFC7577DB116D47147E5EAA2C0A12BD87D393B3577A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:]..@.HaY......&..p.........../D.|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg..6...'...7.*.v|}y.l..b)(.q.p..lY.`>..q.b?{.8.......8p.R=.x.a.....H..8.R...~..2qjM.8...e..J...+9N..............v......%..;~...e..y....T.BI.......?..b*..uj \.7}..w...~..W.^.2....IF......c4k...o...W7Y....g.U..c.x.x.e_.H...|Gb:V.=...{.#..TU]...u.*].@]...E...+j.....?..?...*.*..V..E/..tW%z..4.L.S..w...-l."?9..#.>......84W....y@.'..eI...}y\XkZ.B3..2%.>f.....=9mI.....J\{X...5......!n...l.H....._.b.+i<...Z...+.E.%@...=4O.e.."......7.6B..DX{3GB....4.2..K.`od)4..\..-4.I....B./V...Z.w..8P...6V(5.P.j..w..~l.......GC.tw.Y..._....i.V.z.VK......;...e...t..Z}H..a......I.,.|.f..x..BWH'V+....,M......@_Sf..j...k.Es.v.c.=$Md%C.yz.V....+l.X.....4H.bC.A..6.x.C..]r.9...j..g.\\*m!1.......y..9.....@Tb?..Y..X.._..,.|e..,.Bi.../..J..y..zD.qo..O...t.ypQ,.%... .Y&..nH.7....u1Yr..?..=J.c..E.,QO3......L.Q.%.#Rb.......j.h.X.G=...A..o)...X2.....r..c.....i.rX.^eN.~0v..u..1

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\f7f076c6-9f8f-4649-bcd4-fd6ddd9f5b55

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:LZMA compressed data, non-streamed, size 15688
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9884
                                                                                                                                                                                                                                            Entropy (8bit):7.9817191520734845
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:R6531Z21UcdFW07eHIJY/qB/IcCl9bhbTpXy/olyApmMriRvS6:Re3u1UcdFIOY/qBAdnTpeosApmoiJS6
                                                                                                                                                                                                                                            MD5:D6EC630BC31AE1AE5D238DD3B454A7DE
                                                                                                                                                                                                                                            SHA1:A864F11693B085EFF6743ACB25ABD615A1AE9E6A
                                                                                                                                                                                                                                            SHA-256:6C4E8DB0FBAFBDC9B90BEB3009D6ED9568119F2616A38D7C65C54F13F088EE8C
                                                                                                                                                                                                                                            SHA-512:B2740635D5C510152E680EC88D57E4F479F33E08FF5600603D4FDFF8959A30382543DF6CF76F7720D33EE2E5BC0A921E44A7BF62C9737F1A1ACE9DA6BD3127BD
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:]..@.H=.......&..p.........../D.|.........{...cl..KN......TS;...p....."...gW.....~...~....oF~;....L.c.Jc..k_....P....u*....E.~.Y.......0....\..D...1G.F...v.M.u..$2.;.........td....C...z.....|........olf...e}....d..?wCM.c?.A...A....5.aQ..g..*.b.......1...p0.c....!.6..^..,.g.C. .<..'.;i..=I.,x......K...<f...c$p.eb..we..(.Y.'..p...p?e..8..;C.....I....\.4=m...F....r8.K@9.H..j ....F....1.I.%*Z....:..(...E...5..x?..=.N|.-..^...C..4...)..\..W.c.v?Fe...sE=...h. .fx....L Z...:...y...8.O.6.....3..M<.D.....R.n.fl?%b..M....1=;M.+|...I...J*.....[.wA.'AT.-.r,.3.F....g.5Z.>`...."Z..Va(.f=...&...7.8.&....5..+........p......N|...P..:.a.U6.Z.8j......x9l......|.K.....S...Q...A(<.../.f.1.....4.!....b.1...h..#.\!..S?.bM.$Y...J...D...a6..x..sm....}~3^Hh.(n......A.7t.".^..S..X....{.../.%X...Ve!_l.....o...S....%*,...z.....f.6by.3...H..a...b....,...+:$.'...l..eh.6.4m~PRN.....v5./_....;.x:...h.)...jN..Lu..L...*8=Z|5Y..A.).nS`q.ph..[%..g..v.....&)....I.4.....Q.x.._z}....-.....Ux

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8207176
                                                                                                                                                                                                                                            Entropy (8bit):6.452332377747259
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:HPGafAP4fKA7MTWknT0AufKJKXWu1MTHlFk:vG8AP4fKAoTWknT0AufKJKXWu1MTFu
                                                                                                                                                                                                                                            MD5:B178E9C05511563BDF3A5097D9116197
                                                                                                                                                                                                                                            SHA1:8372B74199C9D2B49C79F2DF61A6734248051A8F
                                                                                                                                                                                                                                            SHA-256:BA37D3942A9C593900B99A86C846013422428366DC42DC3BCA944A6A0FD0A598
                                                                                                                                                                                                                                            SHA-512:15FE06D23A7E1F58E7B7F9038E269B146F7C183A51C7F1C9593DD9E4B1D414748997F1E21FF286383FDDC16D9DEFC5A0908E570C21E7F9E02382709456502631
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......0...ti..ti..ti.....i..r...xi..r...gi..r...fi..r....i.....di.....Ri......vi......|i..}.u.vi.."...ni......i.....wi..ti..yi.."...pi.....ui.....Qi..ti...k......~k......ui......ui..tiq.vi......ui..Richti..................PE..d...L..f.........."....&.&W..H&.......0........@............................. ~.......}...`...........................................n.......n.......|.......x..g..H.}..+....}....(*d......................,d.(...`a[.@............@W.....@.n......................text....$W......&W................. ..`.rdata..:....@W......*W.............@..@.data...`....0o.......o.............@....pdata...g....x..h....x.............@..@.didat..p....`|.......{.............@..._RDATA.......p|.......{.............@..@.rsrc.........|.......{.............@..@.reloc.......}.......|.............@..B................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_mod.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15688
                                                                                                                                                                                                                                            Entropy (8bit):6.95503985774912
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:wO/gdxgZWIYiifoi1/wfT3ir2WSx7bLgfj:tVZLYiiy3iPmbLGj
                                                                                                                                                                                                                                            MD5:A0E61F6A178A498FC127C019BA2DCC24
                                                                                                                                                                                                                                            SHA1:CD3D3DE94BC152B9C51090B3FE6A03EB053F435B
                                                                                                                                                                                                                                            SHA-256:525E717A0E3CE0C1C92209926F5FE71E3764AC82EAE6D4AD22A7941A4110D848
                                                                                                                                                                                                                                            SHA-512:CB23DBDEC077262AF31C2D4A3F83C2162E0B5F0067CF969F082DD268DBD048FBEE6A79935AA4DD9DCBAF3131D00F2A8A8888ADE814ADA29678995023CE385768
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................................*........Rich..................PE..L......f...........!...&..................... ...............................P............@E........................ !..\....#..<....0..............H....+...@..(.... ............................................... .. ............................text...U........................... ..`.rdata....... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus_ui.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12355400
                                                                                                                                                                                                                                            Entropy (8bit):6.575346743980645
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:196608:DPkuwtZB9sRaWX1/gEf+7x3xVUJrqNuG:DcuwtWX1/1mth6JrqNR
                                                                                                                                                                                                                                            MD5:6B2077C64EE0FF998E2FBC1D9E3331C1
                                                                                                                                                                                                                                            SHA1:E10DB878BFC6653E571A752C491410757B0AAD4D
                                                                                                                                                                                                                                            SHA-256:C686CDD74A82DFFD852BFE5B739BD2022835B25941D394935B0EF0EC18453F8E
                                                                                                                                                                                                                                            SHA-512:F1D65E3BF0F4E83D2A61F40E842AB752C137FA872537BC93E091F05373449748999C072EA0CBFB6C353CCB6EADF9697DB7237E89FDBDA018733C0AA8B106462B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........L.zj..zj..zj.R.i..zj.R.o.Xzj......zj...n..zj...o..zj...i..zj.R.n..zj...n.|zj...o.mzj......zj.C.n..zj..zj..zj...o..zj...i..zj...n..zj.R.k..zj..zk."yj...c..{j...j..zj......zj..z...zj...h..zj.Rich.zj.........PE..d.....f.........."....&.$...va......k.........@.............................@......mg....`..........................................R.......S.......`.......0..h...H\...+...p..................................(...@...@............@...............................text....".......$.................. ..`.rdata...j%..@...l%..(..............@..@.data... r4.........................@....pdata..h....0.......h..............@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\product-def.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1326725
                                                                                                                                                                                                                                            Entropy (8bit):5.393225248894363
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:aqiBrS3XIq+W20lihJYsbYmSkG8uDOVB9EjcJ44B5T+kqDBqCsq:aqiBrS2MihJbbpSkG8uDOVB9TRfZqFq6
                                                                                                                                                                                                                                            MD5:64E9654EDBF448A82E04DD5FC0587FF8
                                                                                                                                                                                                                                            SHA1:8326E5931263B5A1A4E032326E06C7764A0D748E
                                                                                                                                                                                                                                            SHA-256:E27CE9139C203B6FB8EA8B8D82D50EDEB2466DF76377DB241AB31F47AF561134
                                                                                                                                                                                                                                            SHA-512:B6065191A2B173DF182DC9B4159E3B6BB715659D353AECF98702A3F0728553E5D193E8FEA7FA8236994C004D89D452F4DDD15552E868F0DB2A7785B2F0162B6F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\product-info.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):9649
                                                                                                                                                                                                                                            Entropy (8bit):5.273780607164147
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:+2RjUS0VmNETL/ZmSStpUzLoHGVlg1sKYxCwexPK8AEMRzyzW2rsq:++vKmNYAtkvDleVzaeWcT
                                                                                                                                                                                                                                            MD5:3695F2E718958E15D63A8CB2C273608B
                                                                                                                                                                                                                                            SHA1:D1D7BA90C3DF2BAFE396F59429F19FAC8AF16211
                                                                                                                                                                                                                                            SHA-256:CC2CA580DA5B640C05276FFE2E08E8B769BF6B8D0158A93023BBCC031AF74749
                                                                                                                                                                                                                                            SHA-512:1F1DAC317196B320A3060441579318525C4C9B0E57B203E81A7FC9D651EF71FCA79DF09CBB8F330DE04F88D1EB4B78EF08DE47CAC5074EE7249901E6BEFC6E84
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>24.9.9452.2135</version>..<build-time>1726655619</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>4c3eed0441406ddeadf69e99b62da68a216bdb798f8451a55324a02ec4800edc</sha-256>....<timestamp>1726655544</timestamp>....<size>7293256</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>ba37d3942a9c593900b99a86c846013422428366dc42dc3bca944a6a0fd0a598</sha-256>....<timestamp>1726655545</timestamp>....<size>8207176</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<name

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\setupui.cont

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:XZ compressed data, checksum CRC32
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):391044
                                                                                                                                                                                                                                            Entropy (8bit):7.99950093995657
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:6144:MFvsbMYNT/9s832RY3TRz0UE7clnj5QJ0WkkC4DEvWugdib:8sbMYNT/dymRz0MNlqgv5Aib
                                                                                                                                                                                                                                            MD5:326F541D5CF5F3DBBFC69A4FBD409389
                                                                                                                                                                                                                                            SHA1:FD59C5062E80CFD58E5F4DFE1FDF129AFD2DD145
                                                                                                                                                                                                                                            SHA-256:3A9BC34B6B2C36180DCA72E2D1C706269D1501EBD9B2C37E39E9E8D5F7D54E5C
                                                                                                                                                                                                                                            SHA-512:A88DA5AB25041442ADED224503864CBD4D370A2866D93E563F2686D590C683462F99FA37BA595C1260EE46FFCC5F35AF51F1423E77EFF1A36F1CC2857D7A3F6A
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:.7zXZ...i".6..!.....F.;...3.M].0...?..Lm.K%. .6.X.....L.@#........EG.6... ...9..L..5.$.e....=.8......],P,....V..E. }?[..u$...{.vv.<.nd....<.....\...A...VmC...@...-...j....J*....b.T..0.G.H.9"~..W).S......;".C..z.%k...7;i.!)7.;I.. a...T..d.%.#.F....$...(..a.-..gR...L7.#.:..1..L...Y.m..I.a....2.]..s,~.{4..e....>$..6....T.@.....k.....z.$'....d.)9.w:...y...(9.4.k.;.d..(.`d\V.O...I.%...'...G....D".wD'..,..........i]...i...`;."......X..g....a..H:....k......$..w.4...g....:Q].....!..n..6....L.......~....^...+......z.W.[/<e8...J~y..y".._.Z.eD..=+..@ 7u..c.D......S.....a>.&. ..y...YHNK..Od ...E.DZ.c.....Hb...t...H..H1-.z..(..s..Y..N...j..a..3.s........1...F...o.+..GW.3.g.......7.^.....f..D.-='...(.N.R.. U..B....F_...t9.N...m;"..[....4k.U..)b...a..Ol..C.V.yJ....R..l.'.........N.....t......cW.[......IK'.f......n.w.0...0. .]...=..'`.v....%\.F;..Om4..v.Y.-z...]..B.z..xbV1..<...n...........KVf]..}2.&.........v..F.Z.37.Gs.p}.l.`.e.r...`Y..o.....$m

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\ecoo.edat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21
                                                                                                                                                                                                                                            Entropy (8bit):3.422577995321604
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:1HRcMK:5RU
                                                                                                                                                                                                                                            MD5:3F44A3C655AC2A5C3AB32849ECB95672
                                                                                                                                                                                                                                            SHA1:93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
                                                                                                                                                                                                                                            SHA-256:51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
                                                                                                                                                                                                                                            SHA-512:D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:mmm_irs_ppi_902_451_o

                                                                                                                                                                                                                                            C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1962
                                                                                                                                                                                                                                            Entropy (8bit):5.410375927777805
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:cEYpa3QzT4zgRAOsMqfJR8cFC3LX1jVRe2lEkNbM:0cWk0sPfD90LXBVQ2FNbM
                                                                                                                                                                                                                                            MD5:B1F7B9E8CA6EBAE67CC8AD3EDBCBE177
                                                                                                                                                                                                                                            SHA1:4AA33228CD80F31AE815F06D29F95B4D185E2929
                                                                                                                                                                                                                                            SHA-256:E3FFC5ADD3055D09520B2814278DDE6DFF8F9346A4F1951ECB4AB39360F52C31
                                                                                                                                                                                                                                            SHA-512:2359596BAF1141C0AD9F961F19353952B02A19B062C646CA70DE158901EB33E26012A7053169838882797727A77B4D0BEBC2752418040EC08B0D02C45838654F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>.<icarus-info xmlns:xs="http://www.w3.org/2001/XMLSchema-instance">..<file-mapping-sfx>...<handle>288</handle>...<size>1698200</size>..</file-mapping-sfx>..<file-list>...<file>....<alias>sfx-info.xml</alias>....<sha-256>8e456e6787fb8d94f883bfe4b24729809b4ab1b7db77cd689bba071b41c2d2d6</sha-256>....<offset>1677894</offset>....<size>717</size>....<timestamp>1726732699</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av/edition.edat</alias>....<sha-256>e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb</sha-256>....<offset>1678688</offset>....<size>2</size>....<timestamp>1726732699</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av/config.def.edat</alias>....<sha-256>ecea99057b475fe1e7b40f93d4d59818e90ae3b948001e5d88dcf908cf241f6a</sha-256>....<offset>1678770</offset>....<size>8290</size>....<timestamp>1726732504</timestamp>....<flags>1</flags>...</file>..</file-list>..<sfx-dir>C:\Windows\Temp\asw.a66b047c

                                                                                                                                                                                                                                            C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1698200
                                                                                                                                                                                                                                            Entropy (8bit):6.76349414914279
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:Vyxo91SfHpooooEPcP7PRGijGi1r3e4Uvr:VyxESfHXPRGijux
                                                                                                                                                                                                                                            MD5:4DE05BCEF050AB8FA30941A9E3454645
                                                                                                                                                                                                                                            SHA1:F2A566C350ED654408CE401DB793C994F842E9AC
                                                                                                                                                                                                                                            SHA-256:FD94EDEF9FB4665ECC48CA1E92C8841059DF3CEFA59B74F7AB93D2814765EF44
                                                                                                                                                                                                                                            SHA-512:D635BAA5CA861B8EECA7614FB5D0E33F22D0808404CE6664CFD0A42EF2E865BE6B17820A942F8614BF5B920A5E1A882DC4D63706C25B4B39DDBCCF37196028E5
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......jZ...;.}.;.}.;.}.I.|!;.}.I.|.;.}(.:}*;.}(..|:;.}(..|4;.}(..|B;.}.I.|7;.}.U.|+;.}'CT},;.}xN.|/;.}.;.}";.}.I.|/;.}.I.|9;.}.;.}.:.}D..|.;.}D..|/;.}D.8}/;.}.;P}-;.}D..|/;.}Rich.;.}........................PE..L...-..f...............&.:..........0........P....@.................................g.....@.................................h...........@r...............+... ......$................................]..@............P...............................text...z8.......:.................. ..`.rdata...c...P...d...>..............@..@.data...P...........................@....didat..T............J..............@....rsrc...@r.......t...L..............@..@.reloc....... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\asw.a66b047c9b0289ec\ecoo.edat

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21
                                                                                                                                                                                                                                            Entropy (8bit):3.422577995321604
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:1HRcMK:5RU
                                                                                                                                                                                                                                            MD5:3F44A3C655AC2A5C3AB32849ECB95672
                                                                                                                                                                                                                                            SHA1:93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
                                                                                                                                                                                                                                            SHA-256:51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
                                                                                                                                                                                                                                            SHA-512:D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:mmm_irs_ppi_902_451_o

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF2D85AFB753245367.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):1.4542540874205625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:XE8PhNuRc06WX4UnT5iLdaiS7qdoCSIN8lgk:LhN1knTnixk
                                                                                                                                                                                                                                            MD5:12C0A6FD518657B7A2FDEFD68A3F7215
                                                                                                                                                                                                                                            SHA1:06BCCF1DB3020AED93F08D1FDCC6AD4BF6A6F4C0
                                                                                                                                                                                                                                            SHA-256:895B7E54097D7E45E1FE2538D4BF12BD82BD9B3CD09392206F95179257429A07
                                                                                                                                                                                                                                            SHA-512:0D59006902B82BE8D39CC068CB395248C192F54C5D9426D3F4E7DB44CC26BA2DB3A8091A16FCBBC62AACE2DA5A0798720286EC9275057B14818EA7E5F0E20F59
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF59599430896BE6F8.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):512
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3::
                                                                                                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF5EDB6D6ECEE40C8D.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):1.4542540874205625
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:XE8PhNuRc06WX4UnT5iLdaiS7qdoCSIN8lgk:LhN1knTnixk
                                                                                                                                                                                                                                            MD5:12C0A6FD518657B7A2FDEFD68A3F7215
                                                                                                                                                                                                                                            SHA1:06BCCF1DB3020AED93F08D1FDCC6AD4BF6A6F4C0
                                                                                                                                                                                                                                            SHA-256:895B7E54097D7E45E1FE2538D4BF12BD82BD9B3CD09392206F95179257429A07
                                                                                                                                                                                                                                            SHA-512:0D59006902B82BE8D39CC068CB395248C192F54C5D9426D3F4E7DB44CC26BA2DB3A8091A16FCBBC62AACE2DA5A0798720286EC9275057B14818EA7E5F0E20F59
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF62F9D3CD98FD9469.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):0.07728575714935673
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOpIWzraCtjBER9J1iVky6l51:2F0i8n0itFzDHFiqjBER9JTr
                                                                                                                                                                                                                                            MD5:87FC8CE0A19F2A7AE5AB2EDCB62F907D
                                                                                                                                                                                                                                            SHA1:B370BCD4C62ADFEB1F140C1524ECEA12B310707C
                                                                                                                                                                                                                                            SHA-256:AB970EEF0513B00293AAD24A43E25E9101B5220FB59291752E63E2841A35E9EA
                                                                                                                                                                                                                                            SHA-512:CEA19F21C4393A92BED63D2E3ADDF97C7C0932F4844935F1F0DA5F337D8EC206138C0D01D0002ADDEB4282981C58221640163AF724FF9231B3E9F1B48B23E3EE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF72FC469683EE5821.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):1.1723475847588438
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:WW1unZM+xFX4rT57LdaiS7qdoCSIN8lgk:J1goTeixk
                                                                                                                                                                                                                                            MD5:C9DDB9AA4795A26F74184B069B0C2E10
                                                                                                                                                                                                                                            SHA1:442CA946F4925A79D9592DD73B375F56D6CD9237
                                                                                                                                                                                                                                            SHA-256:7B2BAB13FB1AD7E95B53D6C9D3C6064741F7ABB7F1C8A2EFCF6E7660F2D0235F
                                                                                                                                                                                                                                            SHA-512:FFFE689725925D342D22B0C9FB40291F7F32EA44CE893B6D6601FD458A75D23637724C34D02BB80807FC292086AB1A73FBCD799794765B0398CD5B1AF1B81EF8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF7D5E76001B305071.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):512
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3::
                                                                                                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF8914F648A654EE2B.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):1.1723475847588438
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:WW1unZM+xFX4rT57LdaiS7qdoCSIN8lgk:J1goTeixk
                                                                                                                                                                                                                                            MD5:C9DDB9AA4795A26F74184B069B0C2E10
                                                                                                                                                                                                                                            SHA1:442CA946F4925A79D9592DD73B375F56D6CD9237
                                                                                                                                                                                                                                            SHA-256:7B2BAB13FB1AD7E95B53D6C9D3C6064741F7ABB7F1C8A2EFCF6E7660F2D0235F
                                                                                                                                                                                                                                            SHA-512:FFFE689725925D342D22B0C9FB40291F7F32EA44CE893B6D6601FD458A75D23637724C34D02BB80807FC292086AB1A73FBCD799794765B0398CD5B1AF1B81EF8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF91B034EF43E06EA8.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):512
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3::
                                                                                                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DF9F627D19276036CB.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):512
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3::
                                                                                                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DFA0EF584F287A1CCA.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):512
                                                                                                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3::
                                                                                                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DFE6DB90002CE59D7D.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):32768
                                                                                                                                                                                                                                            Entropy (8bit):1.1723475847588438
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:WW1unZM+xFX4rT57LdaiS7qdoCSIN8lgk:J1goTeixk
                                                                                                                                                                                                                                            MD5:C9DDB9AA4795A26F74184B069B0C2E10
                                                                                                                                                                                                                                            SHA1:442CA946F4925A79D9592DD73B375F56D6CD9237
                                                                                                                                                                                                                                            SHA-256:7B2BAB13FB1AD7E95B53D6C9D3C6064741F7ABB7F1C8A2EFCF6E7660F2D0235F
                                                                                                                                                                                                                                            SHA-512:FFFE689725925D342D22B0C9FB40291F7F32EA44CE893B6D6601FD458A75D23637724C34D02BB80807FC292086AB1A73FBCD799794765B0398CD5B1AF1B81EF8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\Temp\~DFE8CC3DD70A99A4D7.TMP

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):69632
                                                                                                                                                                                                                                            Entropy (8bit):0.09950797099922111
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:NkQpN8l5ipVvipVJVgd85apG/Zkf3++d85me4:Nk0N8l5S9S7qdoWxdm
                                                                                                                                                                                                                                            MD5:C9606495EFB678B3561F019780EB6C59
                                                                                                                                                                                                                                            SHA1:414A6F9B688E36184C626B132F4BCF495615D0A2
                                                                                                                                                                                                                                            SHA-256:E21799F36B2D711B80707D867FF74E81DFBFCED8F1F6BA36F674477A43A80EA4
                                                                                                                                                                                                                                            SHA-512:9E73BB3AF721757588D46FF6536B60D16E6C9BD0712989EB88A3641DBB7A8AFFC54C95B6D58352DB81EAD26FFCD04E49563BF5ED65A897730FDA98D5D4D92D85
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1835008
                                                                                                                                                                                                                                            Entropy (8bit):4.462946567888249
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:KIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:/XD94+WlLZMM6YFHg+n
                                                                                                                                                                                                                                            MD5:7EF81A36062429E953C519B43F6550F2
                                                                                                                                                                                                                                            SHA1:FB475C5CD61DEAADDC0AA2A07CA151D4BE3D52A6
                                                                                                                                                                                                                                            SHA-256:88BDF035CFE6DEA5CB3AD5D10A04508A6357259F29279CF4CD97FDAEC8E7F5D8
                                                                                                                                                                                                                                            SHA-512:656F36F82E3581A4F4E7FF7D3B5D0F49B55280B4715BE89F69B9673705B7EE9A4F53E61C4C0CADECD9EB42381F6AC62DDD8DBE752B06083457E43B9E5B4B62CA
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..G .................................................................................................................................................................................................................................................................................................................................................yP.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                            Entropy (8bit):7.99560029488531
                                                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                                                            • Win32 Executable (generic) a (10002005/4) 98.04%
                                                                                                                                                                                                                                            • Inno Setup installer (109748/4) 1.08%
                                                                                                                                                                                                                                            • InstallShield setup (43055/19) 0.42%
                                                                                                                                                                                                                                            • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                                                                                                                                            • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                                                                                            File name:SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
                                                                                                                                                                                                                                            File size:29'932'568 bytes
                                                                                                                                                                                                                                            MD5:647a2177841aebe2f1bb1b3767f41287
                                                                                                                                                                                                                                            SHA1:446575615e7fcc9c58fb04cad12909a183a2eb15
                                                                                                                                                                                                                                            SHA256:07c1abb57c4498748c4f1344a786c2c136b82651786ed005d999ecbf6054fb2c
                                                                                                                                                                                                                                            SHA512:f3165aec7a4b7adb7e6ffca56812f769b7b085000d50bf235ca1c7e74d76dfb5549de9561e281623c734c2dec9fc37b54af572c3e97fcb9fb1411102ae3da0c0
                                                                                                                                                                                                                                            SSDEEP:786432:5l3LNCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHi6t:5l3LMEXFhV0KAcNjxAItjFt
                                                                                                                                                                                                                                            TLSH:5F67333FB264747ED8AE5E324A739250997B6A60781F8C1E07F0480DCF365711E3AA5B
                                                                                                                                                                                                                                            File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                                                            Icon Hash:2d2e3797b32b2b99

                                                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Entrypoint:0x4b5eec
                                                                                                                                                                                                                                            Entrypoint Section:.itext
                                                                                                                                                                                                                                            Digitally signed:true
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                                                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                            Time Stamp:0x5FB0F96E [Sun Nov 15 09:48:30 2020 UTC]
                                                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                                                            OS Version Major:6
                                                                                                                                                                                                                                            OS Version Minor:1
                                                                                                                                                                                                                                            File Version Major:6
                                                                                                                                                                                                                                            File Version Minor:1
                                                                                                                                                                                                                                            Subsystem Version Major:6
                                                                                                                                                                                                                                            Subsystem Version Minor:1
                                                                                                                                                                                                                                            Import Hash:5a594319a0d69dbc452e748bcf05892e

                                                                                                                                                                                                                                            Authenticode Signature

                                                                                                                                                                                                                                            Signature Valid:true
                                                                                                                                                                                                                                            Signature Issuer:CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
                                                                                                                                                                                                                                            Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                            Error Number:0
                                                                                                                                                                                                                                            Not Before, Not After
                                                                                                                                                                                                                                            • 11/05/2023 01:00:00 11/05/2025 00:59:59
                                                                                                                                                                                                                                            Subject Chain
                                                                                                                                                                                                                                            • CN=EngineGame, O=EngineGame, S=Tel Aviv, C=IL
                                                                                                                                                                                                                                            Version:3
                                                                                                                                                                                                                                            Thumbprint MD5:91E70EEDB6FAA14A2CAC55AA04E394DC
                                                                                                                                                                                                                                            Thumbprint SHA-1:DB97E8AD1FC01EB0CC39C354F5DB2E8B065C048F
                                                                                                                                                                                                                                            Thumbprint SHA-256:652294C5E648282E1B193DBACCEF545098AF49E60F6176F97A28903CBA4B0870
                                                                                                                                                                                                                                            Serial:2DDFF16E80007EF97AAD7E4F2CF2E34C

                                                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                                                                            add esp, FFFFFFA4h
                                                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                                                            push esi
                                                                                                                                                                                                                                            push edi
                                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-3Ch], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-40h], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-5Ch], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-30h], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-38h], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-34h], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-2Ch], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-28h], eax
                                                                                                                                                                                                                                            mov dword ptr [ebp-14h], eax
                                                                                                                                                                                                                                            mov eax, 004B10F0h
                                                                                                                                                                                                                                            call 00007FB04D560975h
                                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                                            push 004B65E2h
                                                                                                                                                                                                                                            push dword ptr fs:[eax]
                                                                                                                                                                                                                                            mov dword ptr fs:[eax], esp
                                                                                                                                                                                                                                            xor edx, edx
                                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                                            push 004B659Eh
                                                                                                                                                                                                                                            push dword ptr fs:[edx]
                                                                                                                                                                                                                                            mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                                            mov eax, dword ptr [004BE634h]
                                                                                                                                                                                                                                            call 00007FB04D60309Fh
                                                                                                                                                                                                                                            call 00007FB04D602BF2h
                                                                                                                                                                                                                                            lea edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                                            call 00007FB04D5763E8h
                                                                                                                                                                                                                                            mov edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                                            mov eax, 004C1D84h
                                                                                                                                                                                                                                            call 00007FB04D55B567h
                                                                                                                                                                                                                                            push 00000002h
                                                                                                                                                                                                                                            push 00000000h
                                                                                                                                                                                                                                            push 00000001h
                                                                                                                                                                                                                                            mov ecx, dword ptr [004C1D84h]
                                                                                                                                                                                                                                            mov dl, 01h
                                                                                                                                                                                                                                            mov eax, dword ptr [004237A4h]
                                                                                                                                                                                                                                            call 00007FB04D57744Fh
                                                                                                                                                                                                                                            mov dword ptr [004C1D88h], eax
                                                                                                                                                                                                                                            xor edx, edx
                                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                                            push 004B654Ah
                                                                                                                                                                                                                                            push dword ptr fs:[edx]
                                                                                                                                                                                                                                            mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                                            call 00007FB04D603127h
                                                                                                                                                                                                                                            mov dword ptr [004C1D90h], eax
                                                                                                                                                                                                                                            mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                                                            cmp dword ptr [eax+0Ch], 01h
                                                                                                                                                                                                                                            jne 00007FB04D60970Ah
                                                                                                                                                                                                                                            mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                                                            mov edx, 00000028h
                                                                                                                                                                                                                                            call 00007FB04D577D44h
                                                                                                                                                                                                                                            mov edx, dword ptr [004C1D90h]

                                                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xf36.idata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x4800.rsrc
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x1c890780x2ba0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0xc22e40x244.idata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                            Sections

                                                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                            .text0x10000xb361c0xb3800ad6e46e3a3acdb533eb6a077f6d065afFalse0.3448639341051532data6.356058204328091IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .itext0xb50000x16880x1800d40fc822339d01f2abcc5493ac101c94False0.544921875data5.972750055221053IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .data0xb70000x37a40x38004c195d5591f6d61265df08a3733de3a2False0.36097935267857145data5.044400562007734IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                            .bss0xbb0000x6de80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                            .idata0xc20000xf360x1000a73d686f1e8b9bb06ec767721135e397False0.3681640625data4.8987046479600425IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                            .didata0xc30000x1a40x20041b8ce23dd243d14beebc71771885c89False0.345703125data2.7563628682496506IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                            .edata0xc40000x9a0x20037c1a5c63717831863e018c0f51dabb7False0.2578125data1.8722228665884297IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .tls0xc50000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                            .rdata0xc60000x5d0x2008f2f090acd9622c88a6a852e72f94e96False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .rsrc0xc70000x48000x48009ce043cc8ed8e76b0da14bab902ba23eFalse0.3162977430555556data4.422592801275048IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                            Resources

                                                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                            RT_ICON0xc74c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192DutchNetherlands0.5675675675675675
                                                                                                                                                                                                                                            RT_ICON0xc75f00x568Device independent bitmap graphic, 16 x 32 x 8, image size 320DutchNetherlands0.4486994219653179
                                                                                                                                                                                                                                            RT_ICON0xc7b580x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640DutchNetherlands0.4637096774193548
                                                                                                                                                                                                                                            RT_ICON0xc7e400x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1152DutchNetherlands0.3935018050541516
                                                                                                                                                                                                                                            RT_STRING0xc86e80x360data0.34375
                                                                                                                                                                                                                                            RT_STRING0xc8a480x260data0.3256578947368421
                                                                                                                                                                                                                                            RT_STRING0xc8ca80x45cdata0.4068100358422939
                                                                                                                                                                                                                                            RT_STRING0xc91040x40cdata0.3754826254826255
                                                                                                                                                                                                                                            RT_STRING0xc95100x2d4data0.39226519337016574
                                                                                                                                                                                                                                            RT_STRING0xc97e40xb8data0.6467391304347826
                                                                                                                                                                                                                                            RT_STRING0xc989c0x9cdata0.6410256410256411
                                                                                                                                                                                                                                            RT_STRING0xc99380x374data0.4230769230769231
                                                                                                                                                                                                                                            RT_STRING0xc9cac0x398data0.3358695652173913
                                                                                                                                                                                                                                            RT_STRING0xca0440x368data0.3795871559633027
                                                                                                                                                                                                                                            RT_STRING0xca3ac0x2a4data0.4275147928994083
                                                                                                                                                                                                                                            RT_RCDATA0xca6500x10data1.5
                                                                                                                                                                                                                                            RT_RCDATA0xca6600x2c4data0.6384180790960452
                                                                                                                                                                                                                                            RT_RCDATA0xca9240x2cdata1.2045454545454546
                                                                                                                                                                                                                                            RT_GROUP_ICON0xca9500x3edataEnglishUnited States0.8387096774193549
                                                                                                                                                                                                                                            RT_VERSION0xca9900x584dataEnglishUnited States0.26628895184135976
                                                                                                                                                                                                                                            RT_MANIFEST0xcaf140x726XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.4005464480874317

                                                                                                                                                                                                                                            Imports

                                                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                                                            kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                                                                                                                                            comctl32.dllInitCommonControls
                                                                                                                                                                                                                                            version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                                                                                                                                                            user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                                                                                                                                            oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                                                                                                                                            netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                                                                                                                                                                                                                            advapi32.dllRegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                                                                                                                                                                                                                            Exports

                                                                                                                                                                                                                                            NameOrdinalAddress
                                                                                                                                                                                                                                            TMethodImplementationIntercept30x454060
                                                                                                                                                                                                                                            __dbk_fcall_wrapper20x40d0a0
                                                                                                                                                                                                                                            dbkFCallWrapperAddr10x4be63c

                                                                                                                                                                                                                                            Possible Origin

                                                                                                                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                            DutchNetherlands
                                                                                                                                                                                                                                            EnglishUnited States

                                                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                                                            ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                                                            Start time:17:43:41
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe"
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:29'932'568 bytes
                                                                                                                                                                                                                                            MD5 hash:647A2177841AEBE2F1BB1B3767F41287
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:Borland Delphi
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:1
                                                                                                                                                                                                                                            Start time:17:43:42
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-3VLHG.tmp\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.tmp" /SL5="$402A0,29027361,780800,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe"
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:3'025'312 bytes
                                                                                                                                                                                                                                            MD5 hash:2C94C19646786C4EE5283B02FD8CE5A5
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:Borland Delphi
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:5
                                                                                                                                                                                                                                            Start time:17:44:18
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
                                                                                                                                                                                                                                            Imagebase:0x250000
                                                                                                                                                                                                                                            File size:1'184'128 bytes
                                                                                                                                                                                                                                            MD5 hash:143255618462A577DE27286A272584E1
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:6
                                                                                                                                                                                                                                            Start time:17:44:20
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg
                                                                                                                                                                                                                                            Imagebase:0xa50000
                                                                                                                                                                                                                                            File size:234'936 bytes
                                                                                                                                                                                                                                            MD5 hash:26816AF65F2A3F1C61FB44C682510C97
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:7
                                                                                                                                                                                                                                            Start time:17:44:22
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod2_extract\norton_secure_browser_setup.exe" /s /make-default /run_source="norton_ppi_is"
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:5'727'368 bytes
                                                                                                                                                                                                                                            MD5 hash:F269C5140CBC0E376CC7354A801DDD16
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:8
                                                                                                                                                                                                                                            Start time:17:44:23
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Windows\Temp\asw.a66b047c9b0289ec\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /ga_clientid:b9592fc5-5741-4a25-98a5-ccd83d3c903a /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec
                                                                                                                                                                                                                                            Imagebase:0x340000
                                                                                                                                                                                                                                            File size:1'698'200 bytes
                                                                                                                                                                                                                                            MD5 hash:4DE05BCEF050AB8FA30941A9E3454645
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:9
                                                                                                                                                                                                                                            Start time:17:44:24
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:27'406'384 bytes
                                                                                                                                                                                                                                            MD5 hash:E0F666FE4FF537FB8587CCD215E41E5F
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:Borland Delphi
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:10
                                                                                                                                                                                                                                            Start time:17:44:26
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\is-4SDR0.tmp\CheatEngine75.tmp" /SL5="$90282,26511452,832512,C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:3'223'968 bytes
                                                                                                                                                                                                                                            MD5 hash:9AA2ACD4C96F8BA03BB6C3EA806D806F
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:Borland Delphi
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:11
                                                                                                                                                                                                                                            Start time:17:44:26
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\net.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"net" stop BadlionAntic
                                                                                                                                                                                                                                            Imagebase:0x7ff7dd380000
                                                                                                                                                                                                                                            File size:59'904 bytes
                                                                                                                                                                                                                                            MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:12
                                                                                                                                                                                                                                            Start time:17:44:26
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:13
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\net1.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\net1 stop BadlionAntic
                                                                                                                                                                                                                                            Imagebase:0x7ff7ce440000
                                                                                                                                                                                                                                            File size:183'808 bytes
                                                                                                                                                                                                                                            MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:14
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\net.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"net" stop BadlionAnticheat
                                                                                                                                                                                                                                            Imagebase:0x7ff7dd380000
                                                                                                                                                                                                                                            File size:59'904 bytes
                                                                                                                                                                                                                                            MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:15
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:16
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\net1.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\net1 stop BadlionAnticheat
                                                                                                                                                                                                                                            Imagebase:0x7ff7ce440000
                                                                                                                                                                                                                                            File size:183'808 bytes
                                                                                                                                                                                                                                            MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:17
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"sc" delete BadlionAntic
                                                                                                                                                                                                                                            Imagebase:0x7ff747d90000
                                                                                                                                                                                                                                            File size:72'192 bytes
                                                                                                                                                                                                                                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:18
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:19
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"sc" delete BadlionAnticheat
                                                                                                                                                                                                                                            Imagebase:0x7ff747d90000
                                                                                                                                                                                                                                            File size:72'192 bytes
                                                                                                                                                                                                                                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:20
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:21
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\is-K0BUO.tmp\_isetup\_setup64.tmp
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:helper 105 0x42C
                                                                                                                                                                                                                                            Imagebase:0x140000000
                                                                                                                                                                                                                                            File size:6'144 bytes
                                                                                                                                                                                                                                            MD5 hash:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:22
                                                                                                                                                                                                                                            Start time:17:44:27
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:23
                                                                                                                                                                                                                                            Start time:17:44:28
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\icacls.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
                                                                                                                                                                                                                                            Imagebase:0x7ff71da10000
                                                                                                                                                                                                                                            File size:39'424 bytes
                                                                                                                                                                                                                                            MD5 hash:48C87E3B3003A2413D6399EA77707F5D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:24
                                                                                                                                                                                                                                            Start time:17:44:28
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:25
                                                                                                                                                                                                                                            Start time:17:44:31
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\nsm77AC.tmp\NortonBrowserUpdateSetup.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:NortonBrowserUpdateSetup.exe /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
                                                                                                                                                                                                                                            Imagebase:0x680000
                                                                                                                                                                                                                                            File size:1'910'576 bytes
                                                                                                                                                                                                                                            MD5 hash:2B07E26D3C33CD96FA825695823BBFA7
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:26
                                                                                                                                                                                                                                            Start time:17:44:35
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:242'616 bytes
                                                                                                                                                                                                                                            MD5 hash:9AF96706762298CF72DF2A74213494C9
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:27
                                                                                                                                                                                                                                            Start time:17:44:36
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\GUM98FE.tmp\NortonBrowserUpdate.exe" /silent /install "bundlename=Norton Private Browser&appguid={3A3642E6-DE46-4F68-9887-AA017EEFE426}&appname=Norton Private Browser&needsadmin=true&lang=en-GB&brand=29239&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
                                                                                                                                                                                                                                            Imagebase:0x5f0000
                                                                                                                                                                                                                                            File size:440'608 bytes
                                                                                                                                                                                                                                            MD5 hash:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:29
                                                                                                                                                                                                                                            Start time:17:44:38
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:268'704 bytes
                                                                                                                                                                                                                                            MD5 hash:9A4D1B5154194EA0C42EFEBEB73F318F
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:30
                                                                                                                                                                                                                                            Start time:17:44:39
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\icacls.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
                                                                                                                                                                                                                                            Imagebase:0x7ff71da10000
                                                                                                                                                                                                                                            File size:39'424 bytes
                                                                                                                                                                                                                                            MD5 hash:48C87E3B3003A2413D6399EA77707F5D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:31
                                                                                                                                                                                                                                            Start time:17:44:39
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:32
                                                                                                                                                                                                                                            Start time:17:44:44
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:399'264 bytes
                                                                                                                                                                                                                                            MD5 hash:F921416197C2AE407D53BA5712C3930A
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:33
                                                                                                                                                                                                                                            Start time:17:44:45
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                            File size:16'708'024 bytes
                                                                                                                                                                                                                                            MD5 hash:910DE25BD63B5DA521FC0B598920C4EC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:34
                                                                                                                                                                                                                                            Start time:17:44:47
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regsvc
                                                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                                                            File size:440'608 bytes
                                                                                                                                                                                                                                            MD5 hash:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:35
                                                                                                                                                                                                                                            Start time:17:44:48
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                            Imagebase:0x7ff6eef20000
                                                                                                                                                                                                                                            File size:55'320 bytes
                                                                                                                                                                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:36
                                                                                                                                                                                                                                            Start time:17:44:48
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6292 -ip 6292
                                                                                                                                                                                                                                            Imagebase:0x200000
                                                                                                                                                                                                                                            File size:483'680 bytes
                                                                                                                                                                                                                                            MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:37
                                                                                                                                                                                                                                            Start time:17:44:48
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /regserver
                                                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                                                            File size:440'608 bytes
                                                                                                                                                                                                                                            MD5 hash:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:38
                                                                                                                                                                                                                                            Start time:17:44:48
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 972
                                                                                                                                                                                                                                            Imagebase:0x200000
                                                                                                                                                                                                                                            File size:483'680 bytes
                                                                                                                                                                                                                                            MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:39
                                                                                                                                                                                                                                            Start time:17:44:48
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff757af0000
                                                                                                                                                                                                                                            File size:438'592 bytes
                                                                                                                                                                                                                                            MD5 hash:35BDDD897E9CF97CF4074A930F78E496
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:40
                                                                                                                                                                                                                                            Start time:17:44:48
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /c
                                                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                                                            File size:440'608 bytes
                                                                                                                                                                                                                                            MD5 hash:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:41
                                                                                                                                                                                                                                            Start time:17:44:48
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /ua /installsource scheduler
                                                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                                                            File size:440'608 bytes
                                                                                                                                                                                                                                            MD5 hash:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:42
                                                                                                                                                                                                                                            Start time:17:44:49
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff757af0000
                                                                                                                                                                                                                                            File size:438'592 bytes
                                                                                                                                                                                                                                            MD5 hash:35BDDD897E9CF97CF4074A930F78E496
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:43
                                                                                                                                                                                                                                            Start time:17:44:49
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /registermsihelper
                                                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                                                            File size:440'608 bytes
                                                                                                                                                                                                                                            MD5 hash:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:44
                                                                                                                                                                                                                                            Start time:17:44:50
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\1.8.1649.5\NortonBrowserUpdateComRegisterShell64.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff757af0000
                                                                                                                                                                                                                                            File size:438'592 bytes
                                                                                                                                                                                                                                            MD5 hash:35BDDD897E9CF97CF4074A930F78E496
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:45
                                                                                                                                                                                                                                            Start time:17:44:50
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b587398b-0039-49f3-a79c-a0dbe4cb19f9\icarus-info.xml /install /silent /ws /psh:92pTu5hvrwhS3vWuIpMbBBicEVfEyWA6bnyEo3OuuRQXZ1N2XpOzESFJqK8de1eKO42XXRqtAtX7Tg /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.a66b047c9b0289ec /track-guid:b9592fc5-5741-4a25-98a5-ccd83d3c903a
                                                                                                                                                                                                                                            Imagebase:0x7ff6de490000
                                                                                                                                                                                                                                            File size:8'207'176 bytes
                                                                                                                                                                                                                                            MD5 hash:B178E9C05511563BDF3A5097D9116197
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:46
                                                                                                                                                                                                                                            Start time:17:44:50
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                            Imagebase:0x7ff773d50000
                                                                                                                                                                                                                                            File size:69'632 bytes
                                                                                                                                                                                                                                            MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:47
                                                                                                                                                                                                                                            Start time:17:44:52
                                                                                                                                                                                                                                            Start date:13/10/2024
                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\Norton\Browser\Update\NortonBrowserUpdate.exe" /uninstall
                                                                                                                                                                                                                                            Imagebase:0xce0000
                                                                                                                                                                                                                                            File size:440'608 bytes
                                                                                                                                                                                                                                            MD5 hash:BF8FE62DBCD949547AF37EEE4ECE61FC
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                              Function 0018FDE8 Relevance: .3, Instructions: 282COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, Offset: 0018E000, based on PE: false
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_18e000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 4a1c30d10f50ce501c8d687132685218c400b61293b54c62952010d16fe35b63
                                                                                                                                                                                                                                              • Instruction ID: dcb8acfba5cdfda1fa2c5d167fe6b6f300463c71791ca037f25a2fcbbb9e7091
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a1c30d10f50ce501c8d687132685218c400b61293b54c62952010d16fe35b63
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4D9100224093D29BCB13EF38D9A1A937FB1EF03324B6D46EDE5814E013E3654666CB91
                                                                                                                                                                                                                                              Function 001973E0 Relevance: .0, Instructions: 7COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000001.00000002.2949591158.000000000018E000.00000004.00000010.00020000.00000000.sdmp, Offset: 0018E000, based on PE: false
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_18e000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 189748855b7d86b8a61d09dbbd107f1b528e47a1589b4eac06c6b93fd202954f
                                                                                                                                                                                                                                              • Instruction ID: 6ccd567f911c43e44d70a57ca88257c86179a78a2d9493fa17a40a61b6c29f0b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 189748855b7d86b8a61d09dbbd107f1b528e47a1589b4eac06c6b93fd202954f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89B0925A60D7809ED3439B24D8002C03E60DF97241B4B00D190488F172E7B898059322

                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                              Execution Coverage:7.1%
                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                              Signature Coverage:8.9%
                                                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                                                              Total number of Limit Nodes:36
                                                                                                                                                                                                                                              execution_graph 84045 2d97ac 84046 2d97bc 84045->84046 84049 2c293c 84046->84049 84075 2c269d 84049->84075 84052 2c29cd 84056 2c2a45 LoadLibraryExA 84052->84056 84058 2c2aa6 84052->84058 84061 2c2ab8 84052->84061 84064 2c2b74 84052->84064 84053 2c29a9 84054 2c28da DloadReleaseSectionWriteAccess 8 API calls 84053->84054 84055 2c29b4 RaiseException 84054->84055 84070 2c2ba2 84055->84070 84057 2c2a58 GetLastError 84056->84057 84056->84058 84059 2c2a81 84057->84059 84067 2c2a6b 84057->84067 84058->84061 84062 2c2ab1 FreeLibrary 84058->84062 84063 2c28da DloadReleaseSectionWriteAccess 8 API calls 84059->84063 84060 2c2b16 GetProcAddress 84060->84064 84065 2c2b26 GetLastError 84060->84065 84061->84060 84061->84064 84062->84061 84068 2c2a8c RaiseException 84063->84068 84081 2c28da 84064->84081 84069 2c2b39 84065->84069 84067->84058 84067->84059 84068->84070 84069->84064 84071 2c28da DloadReleaseSectionWriteAccess 8 API calls 84069->84071 84072 2c2b5a RaiseException 84071->84072 84073 2c269d ___delayLoadHelper2@8 7 API calls 84072->84073 84074 2c2b71 84073->84074 84074->84064 84076 2c26ca 84075->84076 84077 2c26a9 84075->84077 84076->84052 84076->84053 84089 2c2743 84077->84089 84079 2c26ae 84079->84076 84094 2c286c 84079->84094 84082 2c28ec 84081->84082 84083 2c290e 84081->84083 84084 2c2743 DloadReleaseSectionWriteAccess 4 API calls 84082->84084 84083->84070 84085 2c28f1 84084->84085 84086 2c2909 84085->84086 84087 2c286c DloadProtectSection 3 API calls 84085->84087 84101 2c2910 GetModuleHandleW GetProcAddress GetProcAddress ReleaseSRWLockExclusive DloadGetSRWLockFunctionPointers 84086->84101 84087->84086 84099 2c26d0 GetModuleHandleW GetProcAddress GetProcAddress 84089->84099 84091 2c2748 84092 2c2760 AcquireSRWLockExclusive 84091->84092 84093 2c2764 84091->84093 84092->84079 84093->84079 84096 2c2881 DloadObtainSection 84094->84096 84095 2c2887 84095->84076 84096->84095 84097 2c28bc VirtualProtect 84096->84097 84100 2c2782 VirtualQuery GetSystemInfo 84096->84100 84097->84095 84099->84091 84100->84097 84101->84083 84102 275204 RegOpenKeyExW 84103 275244 RegQueryValueExW 84102->84103 84104 2752e2 84102->84104 84105 2752ca RegCloseKey 84103->84105 84112 275275 84103->84112 84106 2de960 __freea 14 API calls 84104->84106 84105->84104 84107 27538b 84105->84107 84108 2752ea GetLastError 84106->84108 84109 2753de OutputDebugStringW 84107->84109 84115 2753fd __cftof 84107->84115 84108->84107 84152 274f50 84109->84152 84111 2753f0 84114 27549c OutputDebugStringW 84111->84114 84118 275584 84111->84118 84112->84105 84113 2752b4 SetLastError RegCloseKey 84112->84113 84113->84104 84168 274e60 84114->84168 84115->84111 84121 276ae0 5 API calls 84115->84121 84117 275703 84120 27570c LoadLibraryExW 84117->84120 84130 2756f7 84117->84130 84118->84117 84142 2755c4 84118->84142 84119 2754b6 84119->84118 84123 274e60 3 API calls 84119->84123 84122 27571d GetLastError 84120->84122 84120->84130 84121->84111 84124 2de960 __freea 14 API calls 84122->84124 84125 2754c8 84123->84125 84124->84130 84127 275510 84125->84127 84132 2de960 __freea 14 API calls 84125->84132 84135 2754e8 84125->84135 84133 274e60 3 API calls 84127->84133 84127->84142 84128 2756e7 84128->84130 84136 2de960 __freea 14 API calls 84128->84136 84129 2e594f std::locale::_Locimp::_Locimp_ctor 15 API calls 84129->84127 84202 2d8367 84130->84202 84132->84135 84137 275531 84133->84137 84134 27577e 84135->84129 84136->84130 84172 274cc0 84137->84172 84140 274dc0 3 API calls 84141 27566a 84140->84141 84192 2e594f 84141->84192 84184 274dc0 84142->84184 84145 275546 __cftof 84145->84142 84177 276ae0 84145->84177 84146 274dc0 3 API calls 84147 2756ae 84146->84147 84149 274cc0 54 API calls 84147->84149 84150 2756cd OutputDebugStringW 84149->84150 84199 2de960 84150->84199 84153 275099 84152->84153 84154 274f98 84152->84154 84156 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84153->84156 84154->84153 84155 274fae GetCurrentDirectoryW 84154->84155 84157 274fc5 84155->84157 84158 27500b GetLastError 84155->84158 84159 275109 84156->84159 84160 274fd6 GetCurrentDirectoryW 84157->84160 84164 274fec 84158->84164 84159->84111 84162 274ff2 GetLastError 84160->84162 84160->84164 84161 2e594f std::locale::_Locimp::_Locimp_ctor 15 API calls 84163 275045 84161->84163 84162->84164 84163->84153 84165 274cc0 54 API calls 84163->84165 84164->84153 84164->84161 84166 275064 __cftof 84165->84166 84166->84153 84167 276ae0 5 API calls 84166->84167 84167->84153 84169 274e73 84168->84169 84171 274e7c 84168->84171 84170 274dc0 3 API calls 84169->84170 84170->84171 84171->84119 84173 274d2d 84172->84173 84174 274cce swprintf 84172->84174 84173->84145 84174->84173 84209 2e1faa 84174->84209 84178 276bb2 84177->84178 84179 276afc 84177->84179 84180 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84178->84180 84182 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84179->84182 84181 276bc0 84180->84181 84181->84118 84183 276bac 84182->84183 84183->84118 84185 274e49 84184->84185 84189 274dce 84184->84189 84185->84128 84185->84140 84186 274dec GetModuleFileNameW 84187 274e23 84186->84187 84188 274e02 GetLastError 84186->84188 84190 274e2f GetLastError 84187->84190 84191 274e28 84187->84191 84188->84187 84188->84189 84189->84186 84190->84191 84191->84185 84198 2f2174 __cftoe 84192->84198 84193 2f21b2 84194 2dd73d __Wcrtomb 14 API calls 84193->84194 84196 275697 84194->84196 84195 2f219d RtlAllocateHeap 84195->84196 84195->84198 84196->84128 84196->84146 84198->84193 84198->84195 84232 2ef60f EnterCriticalSection LeaveCriticalSection moneypunct 84198->84232 84233 2f2098 84199->84233 84201 2de978 84201->84128 84203 2d836f 84202->84203 84204 2d8370 IsProcessorFeaturePresent 84202->84204 84203->84134 84206 2d9055 84204->84206 84239 2d9018 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 84206->84239 84208 2d9138 84208->84134 84212 2df2ec 84209->84212 84213 2df32c 84212->84213 84214 2df314 84212->84214 84213->84214 84216 2df334 84213->84216 84225 2dd73d 84214->84225 84228 2de6db 48 API calls 2 library calls 84216->84228 84218 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84220 274cf9 84218->84220 84219 2df344 swprintf 84229 2e01c8 54 API calls 4 library calls 84219->84229 84220->84145 84223 2df3cb 84230 2dfafc 14 API calls _free 84223->84230 84224 2df319 __cftof 84224->84218 84231 2f1e00 14 API calls 2 library calls 84225->84231 84227 2dd742 84227->84224 84228->84219 84229->84223 84230->84224 84231->84227 84232->84198 84234 2f20a3 RtlFreeHeap 84233->84234 84238 2f20cc _free 84233->84238 84235 2f20b8 84234->84235 84234->84238 84236 2dd73d __Wcrtomb 12 API calls 84235->84236 84237 2f20be GetLastError 84236->84237 84237->84238 84238->84201 84239->84208 84240 2f732a 84245 2f70bf 84240->84245 84242 2f7340 84243 2f7369 84242->84243 84255 300408 84242->84255 84246 2f70ed 84245->84246 84246->84246 84253 2f723d 84246->84253 84258 2e2041 84246->84258 84247 2dd73d __Wcrtomb 14 API calls 84248 2f7248 __cftof 84247->84248 84248->84242 84250 2f72a5 84251 2e2041 49 API calls 84250->84251 84250->84253 84252 2f72c3 84251->84252 84252->84253 84254 2e2041 49 API calls 84252->84254 84253->84247 84253->84248 84254->84253 84267 2ffb11 84255->84267 84257 300423 84257->84243 84259 2e204f 84258->84259 84263 2e2072 84258->84263 84260 2e2055 84259->84260 84259->84263 84262 2dd73d __Wcrtomb 14 API calls 84260->84262 84265 2e205a __cftof 84262->84265 84266 2e208d 49 API calls 3 library calls 84263->84266 84264 2e2088 84264->84250 84265->84250 84266->84264 84270 2ffb1d __FrameHandler3::FrameUnwindToState 84267->84270 84268 2ffb24 84269 2dd73d __Wcrtomb 14 API calls 84268->84269 84274 2ffb29 __cftof 84269->84274 84270->84268 84271 2ffb4f 84270->84271 84276 3000de 84271->84276 84274->84257 84277 3000fb 84276->84277 84278 300110 84277->84278 84279 300129 84277->84279 84337 2dd72a 14 API calls __Wcrtomb 84278->84337 84323 2fadb9 84279->84323 84282 300115 84287 2dd73d __Wcrtomb 14 API calls 84282->84287 84284 300137 84338 2dd72a 14 API calls __Wcrtomb 84284->84338 84285 30014e 84336 2ffe25 CreateFileW 84285->84336 84312 2ffb73 84287->84312 84289 30013c 84291 2dd73d __Wcrtomb 14 API calls 84289->84291 84290 300204 GetFileType 84293 300256 84290->84293 84294 30020f GetLastError 84290->84294 84291->84282 84292 3001d9 GetLastError 84340 2dd707 14 API calls 3 library calls 84292->84340 84342 2fad04 15 API calls 3 library calls 84293->84342 84341 2dd707 14 API calls 3 library calls 84294->84341 84295 300187 84295->84290 84295->84292 84339 2ffe25 CreateFileW 84295->84339 84299 30021d CloseHandle 84299->84282 84302 300246 84299->84302 84301 3001cc 84301->84290 84301->84292 84303 2dd73d __Wcrtomb 14 API calls 84302->84303 84305 30024b 84303->84305 84304 300277 84306 3002c3 84304->84306 84343 300034 70 API calls 3 library calls 84304->84343 84305->84282 84310 3002ca 84306->84310 84359 2ffbd2 71 API calls 3 library calls 84306->84359 84309 3002f8 84309->84310 84311 300306 84309->84311 84344 2f6b6c 84310->84344 84311->84312 84314 300382 CloseHandle 84311->84314 84322 2ffba6 LeaveCriticalSection __wsopen_s 84312->84322 84360 2ffe25 CreateFileW 84314->84360 84316 3003ad 84317 3003b7 GetLastError 84316->84317 84318 3003e3 84316->84318 84361 2dd707 14 API calls 3 library calls 84317->84361 84318->84312 84320 3003c3 84362 2faecc 15 API calls 3 library calls 84320->84362 84322->84274 84324 2fadc5 __FrameHandler3::FrameUnwindToState 84323->84324 84363 2ecd41 EnterCriticalSection 84324->84363 84326 2fadcc 84328 2fadf1 84326->84328 84332 2fae60 EnterCriticalSection 84326->84332 84333 2fae13 84326->84333 84367 2fab93 15 API calls 3 library calls 84328->84367 84331 2fadf6 84331->84333 84368 2face1 EnterCriticalSection 84331->84368 84332->84333 84334 2fae6d LeaveCriticalSection 84332->84334 84364 2faec3 84333->84364 84334->84326 84336->84295 84337->84282 84338->84289 84339->84301 84340->84282 84341->84299 84342->84304 84343->84306 84370 2faf5d 84344->84370 84346 2f6b7c 84347 2f6b82 84346->84347 84349 2f6bb4 84346->84349 84351 2faf5d __wsopen_s 14 API calls 84346->84351 84381 2faecc 15 API calls 3 library calls 84347->84381 84349->84347 84352 2faf5d __wsopen_s 14 API calls 84349->84352 84350 2f6bda 84353 2f6bfc 84350->84353 84382 2dd707 14 API calls 3 library calls 84350->84382 84354 2f6bab 84351->84354 84355 2f6bc0 CloseHandle 84352->84355 84353->84312 84357 2faf5d __wsopen_s 14 API calls 84354->84357 84355->84347 84358 2f6bcc GetLastError 84355->84358 84357->84349 84358->84347 84359->84309 84360->84316 84361->84320 84362->84318 84363->84326 84369 2ecd91 LeaveCriticalSection 84364->84369 84366 2fae33 84366->84284 84366->84285 84367->84331 84368->84333 84369->84366 84371 2faf7f 84370->84371 84372 2faf6a 84370->84372 84377 2fafa4 84371->84377 84384 2dd72a 14 API calls __Wcrtomb 84371->84384 84383 2dd72a 14 API calls __Wcrtomb 84372->84383 84374 2faf6f 84376 2dd73d __Wcrtomb 14 API calls 84374->84376 84380 2faf77 __cftof 84376->84380 84377->84346 84378 2fafaf 84379 2dd73d __Wcrtomb 14 API calls 84378->84379 84379->84380 84380->84346 84381->84350 84382->84353 84383->84374 84384->84378 84385 2729e0 84386 272a15 84385->84386 84387 272a00 84385->84387 84390 272a2b 84386->84390 84400 272a54 84386->84400 84388 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84387->84388 84389 272a0f 84388->84389 84392 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84390->84392 84391 272b4c 84393 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84391->84393 84394 272a4e 84392->84394 84395 272b60 84393->84395 84397 272ae0 84397->84391 84398 272af0 84397->84398 84401 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84398->84401 84399 272b07 84404 272b1f 84399->84404 84409 2e569d 84399->84409 84400->84391 84400->84399 84402 272a86 84400->84402 84403 272b01 84401->84403 84402->84391 84417 2e4762 52 API calls 4 library calls 84402->84417 84404->84391 84405 272b34 84404->84405 84407 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84405->84407 84408 272b46 84407->84408 84410 2e56ab 84409->84410 84411 2e56bd __cftof 84409->84411 84410->84411 84412 2e56cc 84410->84412 84413 2e56b8 84410->84413 84411->84404 84418 2e547e 84412->84418 84415 2dd73d __Wcrtomb 14 API calls 84413->84415 84415->84411 84417->84397 84419 2e548a __FrameHandler3::FrameUnwindToState 84418->84419 84426 2e582c EnterCriticalSection 84419->84426 84421 2e5498 84427 2e54d9 84421->84427 84425 2e54b6 84425->84404 84426->84421 84435 2f2e58 84427->84435 84431 2e5508 84453 2f2f0b 68 API calls ___scrt_uninitialize_crt 84431->84453 84433 2e54a5 84434 2e54cd LeaveCriticalSection ___scrt_uninitialize_crt 84433->84434 84434->84425 84454 2f2e1c 84435->84454 84437 2f2e69 84459 2fec2a 84437->84459 84439 2f2e6f 84441 2e54ed 84439->84441 84466 2f2174 84439->84466 84444 2e551c 84441->84444 84443 2f2098 _free 14 API calls 84443->84441 84447 2e552e 84444->84447 84448 2e5541 __cftof 84444->84448 84445 2e553c 84446 2dd73d __Wcrtomb 14 API calls 84445->84446 84446->84448 84447->84445 84447->84448 84451 2e5564 _LStrxfrm 84447->84451 84448->84431 84450 2f2e1c __FrameHandler3::FrameUnwindToState 14 API calls 84450->84451 84451->84448 84451->84450 84474 2e4e41 84451->84474 84480 2f5ee6 84451->84480 84453->84433 84455 2f2e3d 84454->84455 84456 2f2e28 84454->84456 84455->84437 84457 2dd73d __Wcrtomb 14 API calls 84456->84457 84458 2f2e2d __cftof 84457->84458 84458->84437 84460 2fec37 84459->84460 84461 2fec44 84459->84461 84462 2dd73d __Wcrtomb 14 API calls 84460->84462 84463 2fec50 84461->84463 84464 2dd73d __Wcrtomb 14 API calls 84461->84464 84465 2fec3c __cftof 84462->84465 84463->84439 84464->84465 84465->84439 84467 2f21b2 84466->84467 84471 2f2182 __cftoe 84466->84471 84468 2dd73d __Wcrtomb 14 API calls 84467->84468 84470 2f21b0 84468->84470 84469 2f219d RtlAllocateHeap 84469->84470 84469->84471 84470->84443 84471->84467 84471->84469 84473 2ef60f EnterCriticalSection LeaveCriticalSection moneypunct 84471->84473 84473->84471 84475 2e4e59 84474->84475 84476 2e4e7e 84474->84476 84475->84476 84477 2f2e1c __FrameHandler3::FrameUnwindToState 14 API calls 84475->84477 84476->84451 84478 2e4e77 84477->84478 84479 2f5ee6 __wsopen_s 68 API calls 84478->84479 84479->84476 84481 2f5ef2 __FrameHandler3::FrameUnwindToState 84480->84481 84482 2f5efa 84481->84482 84483 2f5f12 84481->84483 84546 2dd72a 14 API calls __Wcrtomb 84482->84546 84484 2f5fad 84483->84484 84489 2f5f44 84483->84489 84549 2dd72a 14 API calls __Wcrtomb 84484->84549 84487 2f5eff 84490 2dd73d __Wcrtomb 14 API calls 84487->84490 84488 2f5fb2 84491 2dd73d __Wcrtomb 14 API calls 84488->84491 84503 2face1 EnterCriticalSection 84489->84503 84493 2f5f07 __cftof 84490->84493 84491->84493 84493->84451 84494 2f5f4a 84495 2f5f7b 84494->84495 84496 2f5f66 84494->84496 84504 2f5fd8 84495->84504 84497 2dd73d __Wcrtomb 14 API calls 84496->84497 84499 2f5f6b 84497->84499 84547 2dd72a 14 API calls __Wcrtomb 84499->84547 84500 2f5f76 84548 2f5fa5 LeaveCriticalSection __wsopen_s 84500->84548 84503->84494 84505 2f5ffa 84504->84505 84513 2f600b __cftof 84504->84513 84506 2f5ffe 84505->84506 84509 2f604e 84505->84509 84567 2dd72a 14 API calls __Wcrtomb 84506->84567 84508 2f6003 84510 2dd73d __Wcrtomb 14 API calls 84508->84510 84511 2f6061 84509->84511 84550 2f698d 84509->84550 84510->84513 84553 2f5b7f 84511->84553 84513->84500 84516 2f6077 84518 2f607b 84516->84518 84519 2f60a0 84516->84519 84517 2f60b6 84520 2f610f WriteFile 84517->84520 84521 2f60ca 84517->84521 84531 2f6096 84518->84531 84568 2f5b17 6 API calls __wsopen_s 84518->84568 84569 2f576d 53 API calls 6 library calls 84519->84569 84523 2f6133 GetLastError 84520->84523 84536 2f60ed 84520->84536 84524 2f60ff 84521->84524 84525 2f60d5 84521->84525 84523->84536 84560 2f5bf0 84524->84560 84526 2f60ef 84525->84526 84527 2f60da 84525->84527 84571 2f5db4 8 API calls 3 library calls 84526->84571 84530 2f60df 84527->84530 84527->84531 84570 2f5ccb 7 API calls 2 library calls 84530->84570 84531->84513 84533 2f6159 84531->84533 84534 2f6183 84531->84534 84537 2f6177 84533->84537 84538 2f6160 84533->84538 84534->84513 84541 2dd73d __Wcrtomb 14 API calls 84534->84541 84536->84531 84573 2dd707 14 API calls 3 library calls 84537->84573 84539 2dd73d __Wcrtomb 14 API calls 84538->84539 84542 2f6165 84539->84542 84543 2f619b 84541->84543 84572 2dd72a 14 API calls __Wcrtomb 84542->84572 84574 2dd72a 14 API calls __Wcrtomb 84543->84574 84546->84487 84547->84500 84548->84493 84549->84488 84575 2f68f6 84550->84575 84554 2fec2a __wsopen_s 14 API calls 84553->84554 84555 2f5b90 84554->84555 84559 2f5be6 84555->84559 84585 2f1ca9 48 API calls 3 library calls 84555->84585 84557 2f5bb3 84558 2f5bcd GetConsoleMode 84557->84558 84557->84559 84558->84559 84559->84516 84559->84517 84564 2f5bff __wsopen_s 84560->84564 84561 2f5cb0 84562 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84561->84562 84563 2f5cc9 84562->84563 84563->84531 84564->84561 84565 2f5c6f WriteFile 84564->84565 84565->84564 84566 2f5cb2 GetLastError 84565->84566 84566->84561 84567->84508 84568->84531 84569->84531 84570->84536 84571->84536 84572->84513 84573->84513 84574->84513 84576 2faf5d __wsopen_s 14 API calls 84575->84576 84577 2f6908 84576->84577 84578 2f6921 SetFilePointerEx 84577->84578 84579 2f6910 84577->84579 84581 2f6939 GetLastError 84578->84581 84582 2f6915 84578->84582 84580 2dd73d __Wcrtomb 14 API calls 84579->84580 84580->84582 84584 2dd707 14 API calls 3 library calls 84581->84584 84582->84511 84584->84582 84585->84557 84586 27928d 84625 278fb0 CoCreateGuid 84586->84625 84588 279293 84589 279297 84588->84589 84593 2792e9 84588->84593 84664 269bb0 InitOnceBeginInitialize 84589->84664 84595 279307 84593->84595 84602 279366 84593->84602 84597 269bb0 125 API calls 84595->84597 84598 27930c 84597->84598 84600 269940 164 API calls 84598->84600 84603 27931c 84600->84603 84605 269bb0 125 API calls 84602->84605 84611 2792e0 std::ios_base::_Ios_base_dtor _LStrxfrm 84602->84611 84607 261b84 79 API calls 84603->84607 84606 27937e 84605->84606 84609 269940 164 API calls 84606->84609 84610 279338 84607->84610 84612 27938e 84609->84612 84613 261be0 76 API calls 84610->84613 84614 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84611->84614 84615 261b84 79 API calls 84612->84615 84616 279348 84613->84616 84617 27944c 84614->84617 84618 2793aa 84615->84618 84713 264190 84616->84713 84717 269ab0 84618->84717 84622 2793ba 84624 26b8a0 163 API calls 84622->84624 84623 26b8a0 163 API calls 84623->84611 84624->84611 84626 278fd6 StringFromCLSID 84625->84626 84627 279155 84625->84627 84626->84627 84629 278fee 84626->84629 84628 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84627->84628 84630 279163 84628->84630 84629->84627 84631 278ffe 84629->84631 84630->84588 84632 279169 84631->84632 84638 279050 84631->84638 84649 279020 _LStrxfrm _Mpunct 84631->84649 84739 2634d0 21 API calls collate 84632->84739 84634 27916e 84740 2dd60f 84634->84740 84635 279134 CoTaskMemFree 84642 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84635->84642 84637 279173 Concurrency::cancel_current_task 84639 279180 84637->84639 84638->84637 84640 2790a6 84638->84640 84641 2790cd 84638->84641 84722 28d900 84639->84722 84640->84637 84725 2d8713 84640->84725 84646 2d8713 moneypunct 27 API calls 84641->84646 84647 2790b7 _LStrxfrm 84641->84647 84644 27914f 84642->84644 84644->84588 84646->84647 84647->84634 84647->84649 84648 2791cd __cftof 84650 269bb0 125 API calls 84648->84650 84649->84635 84651 279213 84650->84651 84652 269940 164 API calls 84651->84652 84653 279223 84652->84653 84654 261b84 79 API calls 84653->84654 84655 27923f 84654->84655 84656 269ab0 76 API calls 84655->84656 84657 27924f 84656->84657 84658 264190 5 API calls 84657->84658 84659 27925f 84658->84659 84660 26b8a0 163 API calls 84659->84660 84661 279267 std::ios_base::_Ios_base_dtor 84660->84661 84662 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84661->84662 84663 27944c 84662->84663 84663->84588 84665 269c45 84664->84665 84666 269bef 84664->84666 84797 2e41c9 48 API calls __FrameHandler3::FrameUnwindToState 84665->84797 84668 269c27 84666->84668 84767 269c50 84666->84767 84671 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84668->84671 84673 269c41 84671->84673 84674 269940 84673->84674 84675 269985 84674->84675 84676 269a1c 84674->84676 84675->84676 84679 26998e __cftof 84675->84679 85051 26b420 163 API calls 3 library calls 84676->85051 84678 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84680 269a51 84678->84680 85048 26b420 163 API calls 3 library calls 84679->85048 84689 261b84 84680->84689 84682 2699d5 85049 269820 76 API calls 84682->85049 84684 2699e9 85050 26b690 79 API calls _Mpunct 84684->85050 84686 2699f8 84687 26b8a0 163 API calls 84686->84687 84688 269a00 std::ios_base::_Ios_base_dtor 84687->84688 84688->84678 84690 261bb6 84689->84690 84691 261bbf 84689->84691 85052 2680b0 84690->85052 84693 261be0 84691->84693 84694 261c27 84693->84694 84695 261c1c 84693->84695 84697 26b8a0 84694->84697 85116 2620a0 76 API calls 4 library calls 84695->85116 84698 26b8ff 84697->84698 84706 26b96c _Mpunct 84697->84706 84699 269ab0 76 API calls 84698->84699 84700 26b910 84699->84700 85117 26ba20 84700->85117 84703 26b9e0 84703->84611 84704 26b927 85131 270890 84704->85131 85201 2720f0 84704->85201 85205 2707c0 84704->85205 84705 26b93c 84705->84706 84707 26ba0d 84705->84707 85279 26cd20 84706->85279 84708 2dd60f 11 API calls 84707->84708 84709 26ba12 84708->84709 84714 2641cc 84713->84714 84716 2641d8 84713->84716 84715 264300 5 API calls 84714->84715 84715->84716 84716->84623 84718 269aec 84717->84718 84719 269b1a 84717->84719 85592 2620a0 76 API calls 4 library calls 84718->85592 84719->84622 84721 269afa 84721->84622 84744 28dc50 84722->84744 84724 28d95d 84724->84648 84727 2d8718 84725->84727 84726 2e594f std::locale::_Locimp::_Locimp_ctor 15 API calls 84726->84727 84727->84726 84728 2d8732 84727->84728 84731 263599 moneypunct 84727->84731 84756 2ef60f EnterCriticalSection LeaveCriticalSection moneypunct 84727->84756 84728->84647 84730 2d873e 84730->84730 84731->84730 84733 2635c5 84731->84733 84753 2da332 84731->84753 84734 2d8713 moneypunct 27 API calls 84733->84734 84736 2635cb 84734->84736 84735 2635d2 84735->84647 84736->84735 84757 2dd62c IsProcessorFeaturePresent 84736->84757 84738 2dd62b 84741 2dd61e 84740->84741 84742 2dd62c __Getcoll 11 API calls 84741->84742 84743 2dd62b 84742->84743 84745 28dc90 84744->84745 84749 28dcc5 84744->84749 84750 2d8760 84745->84750 84747 28dc9c 84748 2d8713 moneypunct 27 API calls 84747->84748 84748->84749 84749->84724 84751 2d8713 moneypunct 27 API calls 84750->84751 84752 2d8795 84751->84752 84752->84747 84754 2da34c 84753->84754 84755 2da379 RaiseException 84753->84755 84754->84755 84755->84731 84756->84727 84758 2dd638 84757->84758 84761 2dd453 84758->84761 84762 2dd46f __cftof __FrameHandler3::FrameUnwindToState 84761->84762 84763 2dd49b IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 84762->84763 84766 2dd56c __FrameHandler3::FrameUnwindToState 84763->84766 84764 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84765 2dd58a GetCurrentProcess TerminateProcess 84764->84765 84765->84738 84766->84764 84798 26e310 ConvertStringSecurityDescriptorToSecurityDescriptorW 84767->84798 84770 2d8760 27 API calls 84773 269cc1 84770->84773 84771 26a048 _Mpunct 84772 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84771->84772 84775 269c11 InitOnceComplete 84772->84775 84777 28d900 27 API calls 84773->84777 84796 269e24 _LStrxfrm 84773->84796 84774 269f7e 84774->84771 84776 26a072 84774->84776 84775->84665 84775->84668 84778 2dd60f 11 API calls 84776->84778 84782 269cec 84777->84782 84779 26a077 84778->84779 84780 2d8713 moneypunct 27 API calls 84783 269eec _Mpunct 84780->84783 84781 28d900 27 API calls 84781->84774 84784 28d900 27 API calls 84782->84784 84783->84776 84783->84781 84785 269d4c 84784->84785 84819 2c3b8a 84785->84819 84789 269def 84790 26a06d Concurrency::cancel_current_task 84789->84790 84791 269e74 84789->84791 84792 269e9b 84789->84792 84789->84796 84790->84776 84791->84790 84793 269e7f 84791->84793 84795 2d8713 moneypunct 27 API calls 84792->84795 84792->84796 84794 2d8713 moneypunct 27 API calls 84793->84794 84794->84796 84795->84796 84796->84776 84796->84780 84799 26e37d 84798->84799 84806 26e376 _Mpunct 84798->84806 84843 26deb0 84799->84843 84801 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84803 269ca2 84801->84803 84802 26e3d9 84804 26e3e8 __cftof 84802->84804 84807 26e3dd 84802->84807 84803->84770 84803->84774 84805 26e425 GetModuleFileNameW 84804->84805 84808 26e443 84805->84808 84815 26e54f _Mpunct 84805->84815 84806->84801 84807->84806 84810 26e62e 84807->84810 84895 26daa0 29 API calls 4 library calls 84808->84895 84812 2dd60f 11 API calls 84810->84812 84811 26e454 84811->84815 84896 26dc20 84811->84896 84813 26e633 84812->84813 84815->84807 84815->84810 84816 26e49d _Mpunct 84816->84815 84817 26e629 84816->84817 84818 2dd60f 11 API calls 84817->84818 84818->84810 85005 2c38db 84819->85005 84821 269dd9 84822 271130 84821->84822 85011 273d80 84822->85011 84826 271183 84827 27119d 84826->84827 84828 2713d8 84826->84828 85035 2640e8 84827->85035 85043 2634d0 21 API calls collate 84828->85043 84831 2711bc 85039 273640 28 API calls _LStrxfrm 84831->85039 84832 2dd60f 11 API calls 84834 2713e2 84832->84834 84835 2711cc 85040 273590 28 API calls _LStrxfrm 84835->85040 84837 2711df 85041 26f310 28 API calls 3 library calls 84837->85041 84839 2711f5 85042 273590 28 API calls _LStrxfrm 84839->85042 84841 271208 _Mpunct 84841->84832 84842 2713b9 _Mpunct 84841->84842 84842->84789 84967 2da920 84843->84967 84846 26df16 84848 26dc20 93 API calls 84846->84848 84847 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84849 26e2ee 84847->84849 84850 26df5d _Mpunct 84848->84850 84849->84802 84851 26e00f _Mpunct 84850->84851 84852 26e2f2 84850->84852 84969 26f520 84851->84969 84853 2dd60f 11 API calls 84852->84853 84855 26e2f7 84853->84855 84857 2dd60f 11 API calls 84855->84857 84856 26e084 84984 26e640 84856->84984 84859 26e2fc 84857->84859 84861 2dd60f 11 API calls 84859->84861 84862 26e301 84861->84862 84863 2dd60f 11 API calls 84862->84863 84864 26e306 ConvertStringSecurityDescriptorToSecurityDescriptorW 84863->84864 84867 26e37d 84864->84867 84876 26e376 _Mpunct 84864->84876 84866 26e0e8 _Mpunct 84866->84866 84868 26dc20 93 API calls 84866->84868 84890 26e2bd _Mpunct 84866->84890 84869 26deb0 93 API calls 84867->84869 84875 26e143 _Mpunct 84868->84875 84871 26e3d9 84869->84871 84870 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84872 26e625 84870->84872 84873 26e3e8 __cftof 84871->84873 84877 26e3dd 84871->84877 84872->84802 84874 26e425 GetModuleFileNameW 84873->84874 84878 26e443 84874->84878 84891 26e54f _Mpunct 84874->84891 84875->84859 84880 26e1f5 _Mpunct 84875->84880 84876->84870 84877->84876 84881 26e62e 84877->84881 84999 26daa0 29 API calls 4 library calls 84878->84999 84884 26f520 28 API calls 84880->84884 84883 2dd60f 11 API calls 84881->84883 84882 26e454 84887 26dc20 93 API calls 84882->84887 84882->84891 84885 26e633 84883->84885 84886 26e264 84884->84886 84888 26e640 87 API calls 84886->84888 84893 26e49d _Mpunct 84887->84893 84889 26e27d 84888->84889 84889->84862 84889->84890 84890->84847 84891->84877 84891->84881 84892 26e629 84894 2dd60f 11 API calls 84892->84894 84893->84891 84893->84892 84894->84881 84895->84811 84897 26dc55 84896->84897 84898 26dc83 84896->84898 84899 26f520 28 API calls 84897->84899 84900 26dd83 84898->84900 84901 26dcaa 84898->84901 84902 26dc71 84899->84902 84904 26f520 28 API calls 84900->84904 84903 26f520 28 API calls 84901->84903 84902->84816 84905 26dcb9 84903->84905 84906 26dd92 84904->84906 84907 26f520 28 API calls 84905->84907 84908 26f520 28 API calls 84906->84908 84909 26dce7 84907->84909 84910 26ddc0 84908->84910 85002 26f310 28 API calls 3 library calls 84909->85002 85003 26f310 28 API calls 3 library calls 84910->85003 84913 26dcfd _Mpunct 84914 26dd67 _Mpunct 84913->84914 84915 2dd60f 11 API calls 84913->84915 84914->84816 84916 26dea8 __cftof 84915->84916 84917 26def8 SHGetSpecialFolderPathW 84916->84917 84918 26df16 84917->84918 84962 26e2bd _Mpunct 84917->84962 84920 26dc20 93 API calls 84918->84920 84919 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84921 26e2ee 84919->84921 84922 26df5d _Mpunct 84920->84922 84921->84816 84923 26e00f _Mpunct 84922->84923 84924 26e2f2 84922->84924 84926 26f520 28 API calls 84923->84926 84925 2dd60f 11 API calls 84924->84925 84927 26e2f7 84925->84927 84928 26e084 84926->84928 84929 2dd60f 11 API calls 84927->84929 84930 26e640 87 API calls 84928->84930 84931 26e2fc 84929->84931 84932 26e09d 84930->84932 84933 2dd60f 11 API calls 84931->84933 84932->84927 84938 26e0e8 _Mpunct 84932->84938 84934 26e301 84933->84934 84935 2dd60f 11 API calls 84934->84935 84936 26e306 ConvertStringSecurityDescriptorToSecurityDescriptorW 84935->84936 84939 26e37d 84936->84939 84948 26e376 _Mpunct 84936->84948 84938->84938 84940 26dc20 93 API calls 84938->84940 84938->84962 84941 26deb0 93 API calls 84939->84941 84947 26e143 _Mpunct 84940->84947 84943 26e3d9 84941->84943 84942 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 84944 26e625 84942->84944 84945 26e3e8 __cftof 84943->84945 84949 26e3dd 84943->84949 84944->84816 84946 26e425 GetModuleFileNameW 84945->84946 84950 26e443 84946->84950 84963 26e54f _Mpunct 84946->84963 84947->84931 84952 26e1f5 _Mpunct 84947->84952 84948->84942 84949->84948 84953 26e62e 84949->84953 85004 26daa0 29 API calls 4 library calls 84950->85004 84956 26f520 28 API calls 84952->84956 84955 2dd60f 11 API calls 84953->84955 84954 26e454 84959 26dc20 93 API calls 84954->84959 84954->84963 84957 26e633 84955->84957 84958 26e264 84956->84958 84960 26e640 87 API calls 84958->84960 84961 26e27d 84960->84961 84961->84934 84961->84962 84962->84919 84963->84949 84963->84953 84968 26def8 SHGetSpecialFolderPathW 84967->84968 84968->84846 84968->84890 84972 26f571 84969->84972 84973 26f541 _LStrxfrm 84969->84973 84970 26f677 85000 2634d0 21 API calls collate 84970->85000 84972->84970 84974 26f672 Concurrency::cancel_current_task 84972->84974 84976 26f5d3 84972->84976 84977 26f5fa 84972->84977 84973->84856 84974->84970 84975 2dd60f 11 API calls 84978 26f681 84975->84978 84976->84974 84979 26f5de 84976->84979 84981 2d8713 moneypunct 27 API calls 84977->84981 84982 26f5e4 _LStrxfrm 84977->84982 84980 2d8713 moneypunct 27 API calls 84979->84980 84980->84982 84981->84982 84982->84975 84983 26f658 _Mpunct 84982->84983 84983->84856 84985 26e680 GetFileAttributesW 84984->84985 84986 26e67e 84984->84986 84990 26e690 84985->84990 84995 26e724 _Mpunct 84985->84995 84986->84985 84987 26e736 CreateDirectoryW 84988 26e742 GetLastError 84987->84988 84989 26e09d 84987->84989 84988->84989 84989->84855 84989->84866 84991 26f520 28 API calls 84990->84991 84990->84995 84992 26e6ec 84991->84992 85001 26d6d0 83 API calls 84992->85001 84994 26e6f8 84994->84995 84996 26e77d 84994->84996 84995->84987 84997 2dd60f 11 API calls 84996->84997 84998 26e782 84997->84998 84999->84882 85001->84994 85002->84913 85003->84913 85004->84954 85006 2c38e8 85005->85006 85007 2c38a6 InitializeCriticalSectionEx 85006->85007 85008 2c38c4 InitializeSRWLock 85006->85008 85007->84821 85008->84821 85044 2da3a0 85011->85044 85014 273e15 85015 273e0b OutputDebugStringW 85014->85015 85019 273e3e 85014->85019 85024 273e57 _LStrxfrm _Mpunct 85015->85024 85017 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 85018 271172 85017->85018 85034 273fd0 70 API calls 2 library calls 85018->85034 85020 273f81 OutputDebugStringW 85019->85020 85021 273e4a 85019->85021 85020->85024 85022 273fc0 85021->85022 85021->85024 85026 273e90 85021->85026 85046 2634d0 21 API calls collate 85022->85046 85024->85017 85025 273fc5 85028 2dd60f 11 API calls 85025->85028 85027 273fca Concurrency::cancel_current_task 85026->85027 85029 273ee7 85026->85029 85030 273f0e 85026->85030 85028->85027 85029->85027 85032 2d8713 moneypunct 27 API calls 85029->85032 85031 2d8713 moneypunct 27 API calls 85030->85031 85033 273ef8 _LStrxfrm 85030->85033 85031->85033 85032->85033 85033->85024 85033->85025 85034->84826 85036 264122 85035->85036 85037 264147 _LStrxfrm 85035->85037 85047 2633c3 28 API calls collate 85036->85047 85037->84831 85039->84835 85040->84837 85041->84839 85042->84841 85045 273de7 WTSGetActiveConsoleSessionId 85044->85045 85045->85014 85045->85015 85047->85037 85048->84682 85049->84684 85050->84686 85051->84688 85053 2680f9 85052->85053 85067 268185 _Mpunct 85052->85067 85071 267f60 85053->85071 85057 268109 85087 2681d0 28 API calls 5 library calls 85057->85087 85059 268119 85088 2689b0 85059->85088 85061 268130 85062 264300 5 API calls 85061->85062 85063 26813e 85062->85063 85099 268730 75 API calls 2 library calls 85063->85099 85065 26814b 85066 264300 5 API calls 85065->85066 85068 268156 85066->85068 85067->84691 85068->85067 85069 2dd60f 11 API calls 85068->85069 85070 2681c5 85069->85070 85072 267faa 85071->85072 85082 268076 85071->85082 85100 2c3cd6 85072->85100 85073 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 85075 26809e 85073->85075 85083 264300 85075->85083 85076 267faf std::_Stofx_v2 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 85103 269620 76 API calls 2 library calls 85076->85103 85078 268036 85104 268530 75 API calls 2 library calls 85078->85104 85080 26806b 85081 264300 5 API calls 85080->85081 85081->85082 85082->85073 85085 26430c __EH_prolog3_catch 85083->85085 85110 262c9c 85085->85110 85086 26436d moneypunct 85086->85057 85087->85059 85089 2689ff 85088->85089 85090 262c9c 5 API calls 85089->85090 85098 268a1b 85090->85098 85091 268bce 85091->85061 85093 268c51 85094 2da332 _com_raise_error RaiseException 85093->85094 85095 268c5f 85094->85095 85096 2de960 __freea 14 API calls 85095->85096 85097 268c71 _Mpunct 85096->85097 85097->85061 85098->85091 85115 2628d1 27 API calls 3 library calls 85098->85115 85099->85065 85105 2c6d6a 85100->85105 85103->85078 85104->85080 85106 2c6d7b GetSystemTimePreciseAsFileTime 85105->85106 85107 2c6d87 GetSystemTimeAsFileTime 85105->85107 85108 2c3ce4 85106->85108 85107->85108 85108->85076 85111 262ca8 __EH_prolog3 85110->85111 85112 262cf7 moneypunct 85111->85112 85114 262c33 5 API calls 2 library calls 85111->85114 85112->85086 85114->85112 85115->85093 85116->84694 85122 26ba83 85117->85122 85118 26bba2 85282 2634d0 21 API calls collate 85118->85282 85120 26bb50 85123 2dd60f 11 API calls 85120->85123 85130 26baca _LStrxfrm 85120->85130 85121 26bb9d Concurrency::cancel_current_task 85121->85118 85122->85118 85122->85121 85124 26bb64 85122->85124 85125 26bb43 85122->85125 85122->85130 85126 26bbac 85123->85126 85128 2d8713 moneypunct 27 API calls 85124->85128 85124->85130 85125->85121 85127 26bb4a 85125->85127 85129 2d8713 moneypunct 27 API calls 85127->85129 85128->85130 85129->85120 85130->84704 85283 2c3bab 85131->85283 85134 271045 85348 2c3faf 85134->85348 85135 2708e8 85137 2708f4 ConvertStringSecurityDescriptorToSecurityDescriptorW 85135->85137 85140 270a51 __cftof 85135->85140 85141 270911 85137->85141 85153 270fdb std::ios_base::_Ios_base_dtor __Mtx_unlock 85137->85153 85138 27104b 85139 2dd60f 11 API calls 85138->85139 85150 270f65 85139->85150 85286 273110 85140->85286 85144 26f520 28 API calls 85141->85144 85142 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 85145 27103f 85142->85145 85147 270991 85144->85147 85145->84705 85151 26e640 87 API calls 85147->85151 85363 2628d1 27 API calls 3 library calls 85150->85363 85155 2709a4 85151->85155 85153->85142 85155->85138 85159 2709ec _Mpunct 85155->85159 85158 271087 85163 2da332 _com_raise_error RaiseException 85158->85163 85160 270a31 85159->85160 85161 270a1d 85159->85161 85160->85140 85164 270a42 LocalFree 85160->85164 85161->85153 85165 270a25 LocalFree 85161->85165 85166 271098 85163->85166 85164->85140 85165->85153 85202 2720f9 85201->85202 85204 272123 85201->85204 85202->85204 85545 2e4ef7 85202->85545 85204->84705 85206 2707cb _Mpunct 85205->85206 85207 2dd60f 11 API calls 85206->85207 85209 27083b __Mtx_destroy_in_situ _Mpunct 85206->85209 85208 270884 85207->85208 85210 2c3bab 13 API calls 85208->85210 85209->84705 85211 2708dd 85210->85211 85212 271045 85211->85212 85213 2708e8 85211->85213 85214 2c3faf 79 API calls 85212->85214 85215 2708f4 ConvertStringSecurityDescriptorToSecurityDescriptorW 85213->85215 85218 270a51 __cftof 85213->85218 85216 27104b 85214->85216 85219 270911 85215->85219 85231 270fdb std::ios_base::_Ios_base_dtor __Mtx_unlock 85215->85231 85217 2dd60f 11 API calls 85216->85217 85228 270f65 85217->85228 85221 273110 102 API calls 85218->85221 85222 26f520 28 API calls 85219->85222 85220 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 85223 27103f 85220->85223 85224 270a84 85221->85224 85225 270991 85222->85225 85223->84705 85226 270fa9 85224->85226 85230 2d8713 moneypunct 27 API calls 85224->85230 85277 270c43 _LStrxfrm 85224->85277 85229 26e640 87 API calls 85225->85229 85583 272b90 73 API calls _Mpunct 85226->85583 85584 2628d1 27 API calls 3 library calls 85228->85584 85233 2709a4 85229->85233 85234 270ae1 __cftof 85230->85234 85231->85220 85233->85216 85237 2709ec _Mpunct 85233->85237 85245 2c3367 std::_Lockit::_Lockit 7 API calls 85234->85245 85235 2689b0 27 API calls 85240 270d38 85235->85240 85236 271087 85241 2da332 _com_raise_error RaiseException 85236->85241 85238 270a31 85237->85238 85239 270a1d 85237->85239 85238->85218 85242 270a42 LocalFree 85238->85242 85239->85231 85243 270a25 LocalFree 85239->85243 85246 262c9c 5 API calls 85240->85246 85253 270d68 85240->85253 85244 271098 85241->85244 85242->85218 85243->85231 85248 270b0d 85245->85248 85246->85253 85247 262c9c 5 API calls 85249 270e1f 85247->85249 85576 2c3184 72 API calls 2 library calls 85248->85576 85255 270e6e 85249->85255 85278 272380 70 API calls 85249->85278 85251 270b55 85577 2c33f6 48 API calls 4 library calls 85251->85577 85253->85226 85253->85228 85253->85247 85254 270b61 85578 263128 72 API calls 3 library calls 85254->85578 85255->85226 85261 273030 73 API calls 85255->85261 85257 270b8b 85258 2c3084 std::locale::_Init 57 API calls 85257->85258 85259 270b9c 85258->85259 85579 2c31e9 77 API calls 3 library calls 85259->85579 85264 270f29 85261->85264 85262 270ba9 85263 270be6 85262->85263 85265 2c3367 std::_Lockit::_Lockit 7 API calls 85262->85265 85580 2c5688 77 API calls 9 library calls 85263->85580 85264->85228 85267 270f78 85264->85267 85268 270bc5 85265->85268 85581 26e790 34 API calls 2 library calls 85267->85581 85271 2c33bf std::_Lockit::~_Lockit 2 API calls 85268->85271 85269 270bf7 85273 270c1e 85269->85273 85275 2de960 __freea 14 API calls 85269->85275 85269->85277 85271->85263 85272 270f9f 85582 271740 28 API calls 85272->85582 85275->85273 85277->85235 85278->85255 85585 26cc80 85279->85585 85281 26cd2f _Mpunct 85281->84703 85364 2c394b 85283->85364 85384 26be30 85286->85384 85349 2c3fba 85348->85349 85350 2c3fcd 85349->85350 85351 2e41c9 85349->85351 85541 2c3fdc 78 API calls _com_raise_error 85350->85541 85542 2f4be4 EnterCriticalSection LeaveCriticalSection __FrameHandler3::FrameUnwindToState 85351->85542 85354 2e41ce 85355 2e41d9 85354->85355 85543 2f4c32 48 API calls 6 library calls 85354->85543 85356 2e41e3 IsProcessorFeaturePresent 85355->85356 85362 2e4202 85355->85362 85358 2e41ef 85356->85358 85360 2dd453 __FrameHandler3::FrameUnwindToState 8 API calls 85358->85360 85360->85362 85361 2e420c 85544 2ee9c0 23 API calls __FrameHandler3::FrameUnwindToState 85362->85544 85363->85158 85365 2c39a1 85364->85365 85366 2c3973 GetCurrentThreadId 85364->85366 85369 2c3a05 85365->85369 85370 2c39a5 GetCurrentThreadId 85365->85370 85367 2c397e GetCurrentThreadId 85366->85367 85368 2c3999 85366->85368 85367->85368 85374 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 85368->85374 85371 2c3a9e GetCurrentThreadId 85369->85371 85373 2c3a25 85369->85373 85379 2c39b0 85370->85379 85371->85379 85372 2c3ad5 GetCurrentThreadId 85372->85368 85382 2c3cfd GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime __aulldvrm __Xtime_get_ticks 85373->85382 85377 2708dd 85374->85377 85377->85134 85377->85135 85378 2c3a55 GetCurrentThreadId 85378->85379 85380 2c3a30 __Xtime_diff_to_millis2 85378->85380 85379->85368 85379->85372 85380->85368 85380->85378 85380->85379 85383 2c3cfd GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime __aulldvrm __Xtime_get_ticks 85380->85383 85382->85380 85383->85380 85410 26c0c0 85384->85410 85411 2d8713 moneypunct 27 API calls 85410->85411 85412 26c13a 85411->85412 85413 2c3084 std::locale::_Init 57 API calls 85412->85413 85414 26be3b 85413->85414 85415 26bff0 85414->85415 85416 26c02e 85415->85416 85421 2632de 85416->85421 85422 2632ea __EH_prolog3_GS 85421->85422 85423 2c3367 std::_Lockit::_Lockit 7 API calls 85422->85423 85424 2632f7 85423->85424 85441 262d14 14 API calls 3 library calls 85424->85441 85426 26330e std::locale::_Locimp::_Makeushloc 85428 263320 85426->85428 85442 2631d9 75 API calls 4 library calls 85426->85442 85427 2c33bf std::_Lockit::~_Lockit 2 API calls 85429 263365 85427->85429 85428->85427 85444 2d8def 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 85429->85444 85432 26332e 85434 263335 85432->85434 85435 26336d 85432->85435 85443 2c3052 27 API calls moneypunct 85434->85443 85445 263268 RaiseException _com_raise_error Concurrency::cancel_current_task _Mpunct 85435->85445 85441->85426 85442->85432 85443->85428 85541->85350 85542->85354 85543->85355 85544->85361 85546 2e4f09 85545->85546 85549 2e4f12 ___scrt_uninitialize_crt 85545->85549 85561 2e4d9c 72 API calls ___scrt_uninitialize_crt 85546->85561 85548 2e4f0f 85548->85204 85550 2e4f23 85549->85550 85553 2e4d3c 85549->85553 85550->85204 85554 2e4d48 __FrameHandler3::FrameUnwindToState 85553->85554 85562 2e582c EnterCriticalSection 85554->85562 85556 2e4d56 85563 2e4ea6 85556->85563 85560 2e4d79 85560->85204 85561->85548 85562->85556 85564 2e4ebc 85563->85564 85565 2e4eb3 85563->85565 85567 2e4e41 ___scrt_uninitialize_crt 68 API calls 85564->85567 85574 2e4d9c 72 API calls ___scrt_uninitialize_crt 85565->85574 85568 2e4ec2 85567->85568 85569 2f2e1c __FrameHandler3::FrameUnwindToState 14 API calls 85568->85569 85572 2e4d67 85568->85572 85570 2e4ed8 85569->85570 85575 2f56f0 18 API calls 3 library calls 85570->85575 85573 2e4d90 LeaveCriticalSection ___scrt_uninitialize_crt 85572->85573 85573->85560 85574->85572 85575->85572 85576->85251 85577->85254 85578->85257 85579->85262 85580->85269 85581->85272 85583->85231 85584->85236 85586 26cccb _Mpunct 85585->85586 85587 26cc89 85585->85587 85586->85281 85587->85586 85588 2dd60f 11 API calls 85587->85588 85589 26cd1f 85588->85589 85590 26cc80 11 API calls 85589->85590 85591 26cd2f _Mpunct 85590->85591 85591->85281 85592->84721 85593 2c14c6 85594 2c14d0 85593->85594 85595 2c293c ___delayLoadHelper2@8 16 API calls 85594->85595 85596 2c14dd 85595->85596 85597 2d8aa2 85598 2d8aae __FrameHandler3::FrameUnwindToState 85597->85598 85625 2d83f9 85598->85625 85600 2d8ab5 85601 2d8c08 85600->85601 85610 2d8adf ___scrt_is_nonwritable_in_current_image __FrameHandler3::FrameUnwindToState ___scrt_release_startup_lock 85600->85610 85644 2d93f2 4 API calls 2 library calls 85601->85644 85603 2d8c0f 85637 2ee9fc 85603->85637 85607 2d8c1d 85608 2d8afe 85609 2d8b80 85633 2d950d GetStartupInfoW __cftof 85609->85633 85610->85608 85610->85609 85613 2d8b78 85610->85613 85612 2d8b85 85634 2659aa 85612->85634 85640 2ec768 54 API calls 3 library calls 85613->85640 85616 2d8b7f 85616->85609 85619 2d8ba1 85619->85603 85620 2d8ba5 85619->85620 85621 2d8bae 85620->85621 85642 2ee9b1 23 API calls __FrameHandler3::FrameUnwindToState 85620->85642 85643 2d856a 79 API calls ___scrt_uninitialize_crt 85621->85643 85624 2d8bb6 85624->85608 85626 2d8402 85625->85626 85646 2d9215 IsProcessorFeaturePresent 85626->85646 85628 2d840e 85647 2dbd89 10 API calls 2 library calls 85628->85647 85630 2d8413 85631 2d8417 85630->85631 85648 2dbda8 7 API calls 2 library calls 85630->85648 85631->85600 85633->85612 85649 264e1f 85634->85649 89469 2ee89a 85637->89469 85640->85616 85641 2d9543 GetModuleHandleW 85641->85619 85642->85621 85643->85624 85644->85603 85645 2ee9c0 23 API calls __FrameHandler3::FrameUnwindToState 85645->85607 85646->85628 85647->85630 85648->85631 85892 28d6d0 GetModuleHandleW 85649->85892 85651 264e6c 85652 264ec6 85651->85652 85654 269bb0 125 API calls 85651->85654 85896 264d63 85652->85896 85656 264e7a 85654->85656 85659 269940 164 API calls 85656->85659 85657 264ee0 85661 269bb0 125 API calls 85657->85661 85658 264f39 CoInitializeEx 85660 264f48 85658->85660 85662 264e8a 85659->85662 85663 264f56 85660->85663 85916 265a4f 85660->85916 85665 264ee5 85661->85665 85666 261b84 79 API calls 85662->85666 85667 2d8760 27 API calls 85663->85667 85668 269940 164 API calls 85665->85668 85669 264eab 85666->85669 85670 264f78 85667->85670 85671 264ef5 85668->85671 85672 261be0 76 API calls 85669->85672 85953 265d57 85670->85953 85674 261b84 79 API calls 85671->85674 85673 264ebb 85672->85673 86143 26136c 85673->86143 85676 264f16 85674->85676 85678 261be0 76 API calls 85676->85678 85680 264f26 85678->85680 85679 264f91 85681 264ff1 85679->85681 85682 264f9b 85679->85682 85683 26136c 163 API calls 85680->85683 85684 2d8760 27 API calls 85681->85684 85685 269bb0 125 API calls 85682->85685 85686 264f31 85683->85686 85687 265004 85684->85687 85688 264fa0 85685->85688 85689 2658e3 CloseHandle 85686->85689 85690 2658ef 85686->85690 85957 265db6 85687->85957 85691 269940 164 API calls 85688->85691 85689->85690 85693 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 85690->85693 85692 264fb0 85691->85692 85694 261b84 79 API calls 85692->85694 85695 26590c 85693->85695 85697 264fd1 85694->85697 85695->85641 85699 261be0 76 API calls 85697->85699 85698 265020 85700 26502e 85698->85700 85701 26507b __cftof 85698->85701 85703 264fe1 85699->85703 85702 269bb0 125 API calls 85700->85702 85707 2d8760 27 API calls 85701->85707 85704 265033 85702->85704 85705 26136c 163 API calls 85703->85705 85706 269940 164 API calls 85704->85706 85714 264fec 85705->85714 85708 265043 85706->85708 85709 2650c0 85707->85709 85710 261b84 79 API calls 85708->85710 85711 2650d6 85709->85711 86146 276bd0 29 API calls 3 library calls 85709->86146 85713 26505b 85710->85713 85961 265e16 85711->85961 85717 261be0 76 API calls 85713->85717 86142 2659c2 ReleaseMutex 85714->86142 85721 26506b 85717->85721 85718 2658ce 85718->85686 85719 2658d4 CoUninitialize 85718->85719 85719->85686 85723 26136c 163 API calls 85721->85723 85723->85714 85893 28d6fd 85892->85893 85894 28d6df GetProcAddress 85892->85894 85893->85651 85894->85893 85895 28d6ef 85894->85895 85895->85651 86164 264c8e GetCurrentProcessId 85896->86164 85899 264d7f CreateMutexW 85901 264df4 WaitForSingleObject 85899->85901 85902 264d92 85899->85902 85900 264df0 85900->85657 85900->85658 85901->85900 85903 264e06 85901->85903 85904 269bb0 125 API calls 85902->85904 85903->85900 85905 264e0b CloseHandle 85903->85905 85906 264d97 85904->85906 85905->85900 85907 269940 164 API calls 85906->85907 85908 264da5 85907->85908 85909 261b84 79 API calls 85908->85909 85910 264dc2 85909->85910 85911 261be0 76 API calls 85910->85911 85912 264dd0 GetLastError 85911->85912 85913 266140 75 API calls 85912->85913 85914 264de7 85913->85914 85915 26136c 163 API calls 85914->85915 85915->85900 85917 265a5e __EH_prolog3_GS 85916->85917 86292 265c1e 85917->86292 85920 265a78 85922 269bb0 125 API calls 85920->85922 85921 265b92 _com_issue_error 85923 265a7d 85922->85923 85924 269940 164 API calls 85923->85924 85925 265a8d 85924->85925 85926 261b84 79 API calls 85925->85926 85928 265aa9 85926->85928 85927 265acc 85927->85921 85929 265af5 85927->85929 85930 265b38 85927->85930 85932 261be0 76 API calls 85928->85932 85931 269bb0 125 API calls 85929->85931 85933 269bb0 125 API calls 85930->85933 85934 265afa 85931->85934 85935 265ab9 85932->85935 85936 265b3d 85933->85936 85937 269940 164 API calls 85934->85937 86299 266300 75 API calls 85935->86299 85939 269940 164 API calls 85936->85939 85940 265b0a 85937->85940 85942 265b4d 85939->85942 85943 261b84 79 API calls 85940->85943 85941 265ac7 85945 26136c 163 API calls 85941->85945 85944 261b84 79 API calls 85942->85944 85946 265b26 85943->85946 85947 265b69 85944->85947 85948 265b84 85945->85948 85949 261be0 76 API calls 85946->85949 85950 261be0 76 API calls 85947->85950 86300 2d8def 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 85948->86300 85949->85935 85950->85941 85954 265d63 __EH_prolog3 85953->85954 85955 2d8713 moneypunct 27 API calls 85954->85955 85956 265d7c moneypunct _Mpunct 85955->85956 85956->85679 85958 265dc2 __EH_prolog3 85957->85958 85959 2d8713 moneypunct 27 API calls 85958->85959 85960 265ddb moneypunct 85959->85960 85960->85698 85962 265e22 __EH_prolog3 85961->85962 85963 2d8713 moneypunct 27 API calls 85962->85963 85964 265e3b 85963->85964 86301 265eee 85964->86301 85966 265e6c moneypunct 86142->85718 86144 26b8a0 163 API calls 86143->86144 86145 26139a std::ios_base::_Ios_base_dtor 86144->86145 86145->85652 86146->85711 86165 264cb0 CreateToolhelp32Snapshot 86164->86165 86166 264cc5 Process32FirstW 86165->86166 86174 264cdd 86165->86174 86166->86174 86167 264d44 86171 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 86167->86171 86169 264ce3 Process32NextW 86169->86174 86170 264cf9 CloseHandle 86170->86174 86172 264d58 86171->86172 86172->85899 86172->85900 86173 2e2041 49 API calls 86173->86174 86174->86165 86174->86167 86174->86169 86174->86170 86174->86173 86175 263899 5 API calls 86174->86175 86176 274590 86174->86176 86175->86174 86187 274760 86176->86187 86178 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 86180 27468c 86178->86180 86180->86174 86181 274693 86183 2dd60f 11 API calls 86181->86183 86182 274650 _Mpunct 86182->86178 86184 274698 86183->86184 86185 2746b3 86184->86185 86186 2746ac CloseHandle 86184->86186 86185->86174 86186->86185 86198 274200 OpenProcess 86187->86198 86189 2747a8 86191 2747b2 86189->86191 86270 26daa0 29 API calls 4 library calls 86189->86270 86193 274935 86191->86193 86194 2747e2 _Mpunct 86191->86194 86192 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 86195 274604 86192->86195 86196 2dd60f 11 API calls 86193->86196 86194->86192 86195->86181 86195->86182 86197 27493a 86196->86197 86199 274267 86198->86199 86206 274310 86198->86206 86200 269bb0 125 API calls 86199->86200 86201 27426c 86200->86201 86203 269940 164 API calls 86201->86203 86207 27427c 86203->86207 86204 274351 QueryFullProcessImageNameW 86205 274375 GetLastError 86204->86205 86204->86206 86205->86206 86208 274387 86205->86208 86209 27447f 86206->86209 86271 2746c0 86206->86271 86210 261b84 79 API calls 86207->86210 86211 269bb0 125 API calls 86208->86211 86212 269bb0 125 API calls 86209->86212 86213 274298 86210->86213 86215 27438c 86211->86215 86216 274484 86212->86216 86287 261cc0 76 API calls 86213->86287 86218 269940 164 API calls 86215->86218 86219 269940 164 API calls 86216->86219 86217 2742a3 86221 266140 75 API calls 86217->86221 86222 27439c 86218->86222 86220 274494 86219->86220 86223 261b84 79 API calls 86220->86223 86224 2742b1 86221->86224 86225 261b84 79 API calls 86222->86225 86226 2744b0 86223->86226 86227 274940 76 API calls 86224->86227 86228 2743b8 86225->86228 86229 261be0 76 API calls 86226->86229 86230 2742bc GetLastError 86227->86230 86277 2749d0 86228->86277 86232 2744c0 86229->86232 86233 266140 75 API calls 86230->86233 86235 266140 75 API calls 86232->86235 86236 2742d3 86233->86236 86234 2743c3 86237 266140 75 API calls 86234->86237 86238 2744ce 86235->86238 86239 26b8a0 163 API calls 86236->86239 86240 2743d1 86237->86240 86288 274a60 76 API calls 86238->86288 86248 2742de std::ios_base::_Ios_base_dtor 86239->86248 86282 274940 86240->86282 86243 2744d9 86245 264190 5 API calls 86243->86245 86244 2743dc 86246 266140 75 API calls 86244->86246 86247 2744f5 86245->86247 86249 2743ea 86246->86249 86252 26b8a0 163 API calls 86247->86252 86251 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 86248->86251 86250 26b8a0 163 API calls 86249->86250 86254 2743f5 std::ios_base::_Ios_base_dtor 86250->86254 86253 27457a 86251->86253 86256 274462 std::ios_base::_Ios_base_dtor _Mpunct 86252->86256 86253->86189 86254->86256 86257 274581 86254->86257 86255 27455a CloseHandle 86255->86248 86256->86248 86256->86255 86258 2dd60f 11 API calls 86257->86258 86259 274586 86258->86259 86260 274760 203 API calls 86259->86260 86262 274604 86260->86262 86264 274693 86262->86264 86265 274650 _Mpunct 86262->86265 86270->86191 86272 2746d3 86271->86272 86273 2746e9 86271->86273 86272->86204 86274 2746fa 86273->86274 86289 268eb0 28 API calls 4 library calls 86273->86289 86274->86204 86276 27474a 86276->86204 86278 274a3e 86277->86278 86279 274a0c 86277->86279 86278->86234 86290 2620a0 76 API calls 4 library calls 86279->86290 86281 274a1e 86281->86234 86283 2749ae 86282->86283 86284 27497c 86282->86284 86283->86244 86291 2620a0 76 API calls 4 library calls 86284->86291 86286 27498e 86286->86244 86287->86217 86288->86243 86289->86276 86290->86281 86291->86286 86293 265c64 CoCreateInstance 86292->86293 86294 265c54 86292->86294 86295 265c95 86293->86295 86296 265c86 OleRun 86293->86296 86294->86293 86297 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 86295->86297 86296->86295 86298 265a71 86297->86298 86298->85920 86298->85927 86299->85941 86302 265ef5 86301->86302 86304 265efc _Mpunct 86301->86304 86305 265f8a 5 API calls 2 library calls 86302->86305 86304->85966 89470 2ee8ba 89469->89470 89471 2ee8a8 89469->89471 89481 2ee741 89470->89481 89497 2d9543 GetModuleHandleW 89471->89497 89475 2ee8ad 89475->89470 89498 2ee940 GetModuleHandleExW 89475->89498 89476 2d8c15 89476->85645 89482 2ee74d __FrameHandler3::FrameUnwindToState 89481->89482 89504 2ecd41 EnterCriticalSection 89482->89504 89484 2ee757 89505 2ee7ad 89484->89505 89486 2ee764 89509 2ee782 89486->89509 89489 2ee8fe 89514 2f7cf2 GetPEB 89489->89514 89492 2ee92d 89495 2ee940 __FrameHandler3::FrameUnwindToState 3 API calls 89492->89495 89493 2ee90d GetPEB 89493->89492 89494 2ee91d GetCurrentProcess TerminateProcess 89493->89494 89494->89492 89496 2ee935 ExitProcess 89495->89496 89497->89475 89499 2ee95f GetProcAddress 89498->89499 89500 2ee982 89498->89500 89501 2ee974 89499->89501 89502 2ee988 FreeLibrary 89500->89502 89503 2ee8b9 89500->89503 89501->89500 89502->89503 89503->89470 89504->89484 89506 2ee7b9 __FrameHandler3::FrameUnwindToState 89505->89506 89508 2ee81a __FrameHandler3::FrameUnwindToState 89506->89508 89512 2ef40b 14 API calls __FrameHandler3::FrameUnwindToState 89506->89512 89508->89486 89513 2ecd91 LeaveCriticalSection 89509->89513 89511 2ee770 89511->89476 89511->89489 89512->89508 89513->89511 89515 2f7d0c 89514->89515 89516 2ee908 89514->89516 89518 2f42b4 5 API calls _unexpected 89515->89518 89516->89492 89516->89493 89518->89516 89519 285318 89520 2d88fa 6 API calls 89519->89520 89521 285322 89520->89521 89522 28571a 89521->89522 89524 2d8713 moneypunct 27 API calls 89521->89524 89643 286440 89522->89643 89526 28535e 89524->89526 89525 28575a GetModuleHandleW 89531 285816 89525->89531 89636 284a40 89526->89636 89528 2853a7 89530 284a40 33 API calls 89528->89530 89532 2853ba 89530->89532 89534 286440 27 API calls 89531->89534 89533 284a40 33 API calls 89532->89533 89535 2853cb 89533->89535 89536 285885 89534->89536 89658 2861f0 29 API calls 3 library calls 89535->89658 89653 2865c0 89536->89653 89539 2853e9 89542 284a40 33 API calls 89539->89542 89540 28588c 89541 286440 27 API calls 89540->89541 89550 28595c 89541->89550 89543 285486 89542->89543 89544 284a40 33 API calls 89543->89544 89545 285499 89544->89545 89546 284a40 33 API calls 89545->89546 89547 2854aa 89546->89547 89659 2861f0 29 API calls 3 library calls 89547->89659 89549 2854c8 89551 284a40 33 API calls 89549->89551 89552 286440 27 API calls 89550->89552 89553 285565 89551->89553 89560 285ae8 89552->89560 89554 284a40 33 API calls 89553->89554 89555 285578 89554->89555 89556 284a40 33 API calls 89555->89556 89557 285589 89556->89557 89660 2861f0 29 API calls 3 library calls 89557->89660 89559 2855a7 89565 284a40 33 API calls 89559->89565 89590 285b83 std::ios_base::_Ios_base_dtor _Mpunct 89560->89590 89664 2611f3 29 API calls 2 library calls 89560->89664 89562 285bdb 89564 285be6 89562->89564 89573 285cfc _Mpunct 89562->89573 89563 286440 27 API calls 89571 285cc5 89563->89571 89566 269bb0 125 API calls 89564->89566 89567 28564e 89565->89567 89570 285beb 89566->89570 89568 284a40 33 API calls 89567->89568 89572 285661 89568->89572 89569 286440 27 API calls 89574 285d62 89569->89574 89575 269940 164 API calls 89570->89575 89576 285e30 89571->89576 89577 285de7 89571->89577 89592 285cd3 _LStrxfrm 89571->89592 89578 284a40 33 API calls 89572->89578 89573->89569 89574->89590 89665 27aad0 28 API calls 4 library calls 89574->89665 89579 285bfb 89575->89579 89588 2d8713 moneypunct 27 API calls 89576->89588 89576->89592 89580 285df2 89577->89580 89581 286085 Concurrency::cancel_current_task 89577->89581 89582 285672 89578->89582 89584 261b84 79 API calls 89579->89584 89586 2d8713 moneypunct 27 API calls 89580->89586 89585 28608a 89581->89585 89661 2861f0 29 API calls 3 library calls 89582->89661 89589 285c17 89584->89589 89591 2dd60f 11 API calls 89585->89591 89586->89592 89588->89592 89594 261be0 76 API calls 89589->89594 89590->89563 89595 28608f 89591->89595 89592->89585 89598 285ebc _Mpunct 89592->89598 89593 285690 89602 2d8713 moneypunct 27 API calls 89593->89602 89596 285c27 89594->89596 89597 2dd60f 11 API calls 89595->89597 89599 26b8a0 163 API calls 89596->89599 89611 286094 _Mpunct 89597->89611 89601 286440 27 API calls 89598->89601 89617 285f73 _Mpunct 89598->89617 89599->89590 89600 285f82 GetModuleHandleW 89603 285fc1 89600->89603 89604 285f95 GetProcAddress 89600->89604 89605 285f2f 89601->89605 89606 2856d2 89602->89606 89614 286440 27 API calls 89603->89614 89604->89603 89607 285fa7 GetCurrentProcess 89604->89607 89608 285f45 89605->89608 89666 27aad0 28 API calls 4 library calls 89605->89666 89662 2d85bf 17 API calls 89606->89662 89607->89603 89608->89595 89608->89600 89608->89617 89629 286166 _Mpunct 89611->89629 89671 2867b0 12 API calls _Mpunct 89611->89671 89613 285710 89663 2d88b0 EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 89613->89663 89618 286022 89614->89618 89615 2860f4 89623 28610e SysFreeString 89615->89623 89626 28611b _Mpunct 89615->89626 89617->89600 89667 2636db 27 API calls collate 89618->89667 89619 2dd60f 11 API calls 89620 2861d9 89619->89620 89622 28602a 89668 26372a 5 API calls collate 89622->89668 89623->89626 89624 2861b4 _Mpunct 89627 286159 SysFreeString 89626->89627 89626->89629 89627->89629 89628 286032 89669 26372a 5 API calls collate 89628->89669 89629->89619 89629->89624 89631 28603a 89670 26372a 5 API calls collate 89631->89670 89633 286042 89634 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 89633->89634 89635 286059 89634->89635 89637 2d8713 moneypunct 27 API calls 89636->89637 89638 284a6e 89637->89638 89640 284aa5 _com_issue_error 89638->89640 89672 2d9900 89638->89672 89641 284afc SysFreeString 89640->89641 89642 284ab8 _Mpunct 89640->89642 89641->89642 89642->89528 89652 286496 89643->89652 89644 2864fd 89646 2d8713 moneypunct 27 API calls 89644->89646 89645 2865af 89694 269b40 27 API calls 2 library calls 89645->89694 89648 286515 89646->89648 89693 286bb0 11 API calls _Mpunct 89648->89693 89649 2865b4 89651 2864e8 89651->89525 89652->89644 89652->89645 89652->89651 89654 2865cc 89653->89654 89655 2865ef _Mpunct 89653->89655 89654->89655 89656 2dd60f 11 API calls 89654->89656 89655->89540 89657 286639 89656->89657 89658->89539 89659->89549 89660->89559 89661->89593 89662->89613 89663->89522 89664->89562 89665->89590 89666->89608 89667->89622 89668->89628 89669->89631 89670->89633 89671->89615 89673 2d993d 89672->89673 89674 2d9960 89672->89674 89675 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 89673->89675 89677 2d9a33 _com_issue_error 89674->89677 89678 2d997f MultiByteToWideChar 89674->89678 89676 2d995a 89675->89676 89676->89640 89680 2d9a47 GetLastError 89677->89680 89679 2d999c 89678->89679 89678->89680 89681 2e594f std::locale::_Locimp::_Locimp_ctor 15 API calls 89679->89681 89682 2d99ae __Strxfrm 89679->89682 89683 2d9a51 _com_issue_error 89680->89683 89681->89682 89682->89677 89685 2d99fa MultiByteToWideChar 89682->89685 89684 2d9a70 GetLastError 89683->89684 89686 2de960 __freea 14 API calls 89683->89686 89687 2d9a7a _com_issue_error 89684->89687 89685->89683 89688 2d9a0e SysAllocString 89685->89688 89689 2d9a6d 89686->89689 89687->89640 89690 2d9a1f 89688->89690 89692 2d9a25 89688->89692 89689->89684 89691 2de960 __freea 14 API calls 89690->89691 89691->89692 89692->89673 89692->89677 89693->89651 89694->89649 89695 2b4cfa 89696 2b4c79 89695->89696 89697 2c293c ___delayLoadHelper2@8 16 API calls 89696->89697 89697->89696 89698 277156 89699 2d8713 moneypunct 27 API calls 89698->89699 89700 27715c _LStrxfrm 89699->89700 89701 2771bf 89700->89701 89710 27722a 89700->89710 89702 269bb0 125 API calls 89701->89702 89703 2771c4 89702->89703 89704 269940 164 API calls 89703->89704 89706 2771d4 89704->89706 89705 277df1 89950 2634d0 21 API calls collate 89705->89950 89707 261b84 79 API calls 89706->89707 89709 2771f0 89707->89709 89712 269ab0 76 API calls 89709->89712 89710->89705 89713 2772b4 89710->89713 89714 2772db 89710->89714 89726 27725f _LStrxfrm 89710->89726 89716 277200 89712->89716 89717 277dfc Concurrency::cancel_current_task 89713->89717 89720 2d8713 moneypunct 27 API calls 89713->89720 89721 2d8713 moneypunct 27 API calls 89714->89721 89714->89726 89718 261c50 76 API calls 89716->89718 89722 277e01 89717->89722 89724 27720e 89718->89724 89719 277348 89725 269bb0 125 API calls 89719->89725 89720->89726 89721->89726 89723 2dd60f 11 API calls 89722->89723 89727 277e06 89723->89727 89942 278f20 76 API calls 89724->89942 89729 27734d 89725->89729 89726->89719 89726->89722 89739 2773b3 89726->89739 89732 269bb0 125 API calls 89727->89732 89731 269940 164 API calls 89729->89731 89730 277219 89733 26b8a0 163 API calls 89730->89733 89734 27735d 89731->89734 89735 277e5c 89732->89735 89810 277221 std::ios_base::_Ios_base_dtor __Mtx_unlock _Mpunct 89733->89810 89736 261b84 79 API calls 89734->89736 89737 269940 164 API calls 89735->89737 89738 277379 89736->89738 89740 277e6c 89737->89740 89741 261be0 76 API calls 89738->89741 89739->89705 89742 277443 89739->89742 89743 27746a 89739->89743 89752 2773ee _LStrxfrm 89739->89752 89744 261b84 79 API calls 89740->89744 89745 277389 89741->89745 89742->89717 89746 2d8713 moneypunct 27 API calls 89742->89746 89747 2d8713 moneypunct 27 API calls 89743->89747 89743->89752 89748 277e88 89744->89748 89749 261c50 76 API calls 89745->89749 89746->89752 89747->89752 89753 261be0 76 API calls 89748->89753 89754 277397 89749->89754 89750 2774d7 89751 269bb0 125 API calls 89750->89751 89756 2774dc 89751->89756 89752->89722 89752->89750 89769 277542 89752->89769 89757 277e98 89753->89757 89943 278f20 76 API calls 89754->89943 89759 269940 164 API calls 89756->89759 89760 26b8a0 163 API calls 89757->89760 89758 2773a2 89762 26b8a0 163 API calls 89758->89762 89763 2774ec 89759->89763 89774 277ea3 std::ios_base::_Ios_base_dtor 89760->89774 89761 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 89764 277dea 89761->89764 89762->89810 89765 261b84 79 API calls 89763->89765 89768 277508 89765->89768 89766 277d49 89885 284b40 89766->89885 89767 2776d8 89767->89705 89779 27786e 89767->89779 89783 277795 89767->89783 89784 27776c 89767->89784 89807 277715 _LStrxfrm 89767->89807 89771 261be0 76 API calls 89768->89771 89769->89705 89769->89767 89776 2775d6 89769->89776 89777 2775ff 89769->89777 89795 27757f _LStrxfrm 89769->89795 89778 277518 89771->89778 89773 277b9d 89773->89705 89773->89766 89782 277c00 89773->89782 89831 277bde _LStrxfrm 89773->89831 89775 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 89774->89775 89780 2785c6 89775->89780 89776->89717 89788 2d8713 moneypunct 27 API calls 89776->89788 89789 2d8713 moneypunct 27 API calls 89777->89789 89777->89795 89785 261c50 76 API calls 89778->89785 89779->89705 89781 277a07 89779->89781 89786 277905 89779->89786 89787 27792e 89779->89787 89811 2778ae _LStrxfrm 89779->89811 89781->89705 89781->89773 89793 277ac2 89781->89793 89794 277a9b 89781->89794 89822 277a44 _LStrxfrm 89781->89822 89805 277c35 89782->89805 89806 277c5c 89782->89806 89799 2d8713 moneypunct 27 API calls 89783->89799 89783->89807 89784->89717 89796 2d8713 moneypunct 27 API calls 89784->89796 89790 277526 89785->89790 89786->89717 89801 2d8713 moneypunct 27 API calls 89786->89801 89803 2d8713 moneypunct 27 API calls 89787->89803 89787->89811 89788->89795 89789->89795 89944 278f20 76 API calls 89790->89944 89791 27766d 89798 269bb0 125 API calls 89791->89798 89792 277803 89802 269bb0 125 API calls 89792->89802 89815 2d8713 moneypunct 27 API calls 89793->89815 89793->89822 89794->89717 89813 2d8713 moneypunct 27 API calls 89794->89813 89795->89722 89795->89767 89795->89791 89796->89807 89809 277672 89798->89809 89799->89807 89801->89811 89812 277808 89802->89812 89803->89811 89804 27799c 89814 269bb0 125 API calls 89804->89814 89805->89717 89816 277c40 89805->89816 89826 2d8713 moneypunct 27 API calls 89806->89826 89806->89831 89807->89722 89807->89779 89807->89792 89808 277531 89818 26b8a0 163 API calls 89808->89818 89819 269940 164 API calls 89809->89819 89810->89761 89811->89722 89811->89781 89811->89804 89821 269940 164 API calls 89812->89821 89813->89822 89823 2779a1 89814->89823 89815->89822 89824 2d8713 moneypunct 27 API calls 89816->89824 89817 277b32 89825 269bb0 125 API calls 89817->89825 89818->89810 89827 277682 89819->89827 89820 277ccc 89828 269bb0 125 API calls 89820->89828 89829 277818 89821->89829 89822->89722 89822->89773 89822->89817 89830 269940 164 API calls 89823->89830 89824->89831 89832 277b37 89825->89832 89826->89831 89833 261b84 79 API calls 89827->89833 89835 277cd1 89828->89835 89836 261b84 79 API calls 89829->89836 89837 2779b1 89830->89837 89831->89722 89831->89766 89831->89820 89838 269940 164 API calls 89832->89838 89834 27769e 89833->89834 89839 261be0 76 API calls 89834->89839 89840 269940 164 API calls 89835->89840 89841 277834 89836->89841 89842 261b84 79 API calls 89837->89842 89843 277b47 89838->89843 89845 2776ae 89839->89845 89846 277ce1 89840->89846 89847 261be0 76 API calls 89841->89847 89848 2779cd 89842->89848 89844 261b84 79 API calls 89843->89844 89849 277b63 89844->89849 89850 261c50 76 API calls 89845->89850 89851 261b84 79 API calls 89846->89851 89852 277844 89847->89852 89853 261be0 76 API calls 89848->89853 89854 261be0 76 API calls 89849->89854 89855 2776bc 89850->89855 89856 277cfd 89851->89856 89857 261c50 76 API calls 89852->89857 89858 2779dd 89853->89858 89859 277b73 89854->89859 89945 278f20 76 API calls 89855->89945 89861 261be0 76 API calls 89856->89861 89862 277852 89857->89862 89863 261c50 76 API calls 89858->89863 89864 261c50 76 API calls 89859->89864 89866 277d0d 89861->89866 89946 278f20 76 API calls 89862->89946 89868 2779eb 89863->89868 89869 277b81 89864->89869 89865 2776c7 89870 26b8a0 163 API calls 89865->89870 89871 261c50 76 API calls 89866->89871 89947 278f20 76 API calls 89868->89947 89948 278f20 76 API calls 89869->89948 89870->89810 89875 277d1b 89871->89875 89872 27785d 89876 26b8a0 163 API calls 89872->89876 89949 278f20 76 API calls 89875->89949 89876->89810 89877 2779f6 89880 26b8a0 163 API calls 89877->89880 89878 277b8c 89881 26b8a0 163 API calls 89878->89881 89880->89810 89881->89810 89882 277d26 89883 26b8a0 163 API calls 89882->89883 89883->89810 89951 2852d0 89885->89951 89887 284b83 89888 2d8713 moneypunct 27 API calls 89887->89888 89889 284c08 89888->89889 90027 286340 89889->90027 89891 284eba 89892 281b40 29 API calls 89891->89892 89903 284ec9 _Mpunct 89892->89903 89894 286360 27 API calls 89909 284d1a 89894->89909 89895 284f98 89899 284fc2 89895->89899 90033 282f20 29 API calls 3 library calls 89895->90033 89897 284c8a 89897->89909 90030 286c80 29 API calls moneypunct 89897->90030 89900 28517d 89899->89900 89901 28502e 89899->89901 89915 28500e _LStrxfrm 89899->89915 90034 2634d0 21 API calls collate 89900->90034 89910 28508b 89901->89910 89911 285062 89901->89911 89902 285187 89906 2dd60f 11 API calls 89902->89906 89903->89895 89903->89902 90032 2677a9 5 API calls collate 89903->90032 89908 28518c 89906->89908 89907 285182 Concurrency::cancel_current_task 89907->89902 89919 269bb0 125 API calls 89908->89919 89909->89891 89909->89894 89912 2d8713 moneypunct 27 API calls 89909->89912 89916 2e594f std::locale::_Locimp::_Locimp_ctor 15 API calls 89909->89916 90031 286640 27 API calls 3 library calls 89909->90031 89910->89915 89918 2d8713 moneypunct 27 API calls 89910->89918 89911->89907 89914 28506d 89911->89914 89912->89909 89913 2de960 __freea 14 API calls 89929 2850d8 _Mpunct 89913->89929 89917 2d8713 moneypunct 27 API calls 89914->89917 89915->89913 89916->89909 89920 285073 89917->89920 89918->89915 89921 2851cb 89919->89921 89920->89902 89920->89915 89922 269940 164 API calls 89921->89922 89924 2851db 89922->89924 89923 2de960 __freea 14 API calls 89926 28513b _Mpunct 89923->89926 89927 261b84 79 API calls 89924->89927 89925 28510c _Mpunct 89925->89923 89929->89925 89931 2de960 __freea 14 API calls 89929->89931 89931->89929 89942->89730 89943->89758 89944->89808 89945->89865 89946->89872 89947->89877 89948->89878 89949->89882 89952 28571d 89951->89952 89953 286440 27 API calls 89952->89953 89954 28575a GetModuleHandleW 89953->89954 89956 285816 89954->89956 89957 286440 27 API calls 89956->89957 89958 285885 89957->89958 89959 2865c0 11 API calls 89958->89959 89960 28588c 89959->89960 89961 286440 27 API calls 89960->89961 89962 28595c 89961->89962 89963 286440 27 API calls 89962->89963 89964 285ae8 89963->89964 89987 285b83 std::ios_base::_Ios_base_dtor _Mpunct 89964->89987 90035 2611f3 29 API calls 2 library calls 89964->90035 89966 285bdb 89968 285be6 89966->89968 89973 285cfc _Mpunct 89966->89973 89967 286440 27 API calls 89972 285cc5 89967->89972 89969 269bb0 125 API calls 89968->89969 89971 285beb 89969->89971 89970 286440 27 API calls 89974 285d62 89970->89974 89975 269940 164 API calls 89971->89975 89976 285e30 89972->89976 89977 285de7 89972->89977 89989 285cd3 _LStrxfrm 89972->89989 89973->89970 89974->89987 90036 27aad0 28 API calls 4 library calls 89974->90036 89978 285bfb 89975->89978 89985 2d8713 moneypunct 27 API calls 89976->89985 89976->89989 89979 285df2 89977->89979 89980 286085 Concurrency::cancel_current_task 89977->89980 89982 261b84 79 API calls 89978->89982 89984 2d8713 moneypunct 27 API calls 89979->89984 89983 28608a 89980->89983 89986 285c17 89982->89986 89988 2dd60f 11 API calls 89983->89988 89984->89989 89985->89989 89990 261be0 76 API calls 89986->89990 89987->89967 89991 28608f 89988->89991 89989->89983 89994 285ebc _Mpunct 89989->89994 89992 285c27 89990->89992 89993 2dd60f 11 API calls 89991->89993 89995 26b8a0 163 API calls 89992->89995 90004 286094 _Mpunct 89993->90004 89997 286440 27 API calls 89994->89997 90008 285f73 _Mpunct 89994->90008 89995->89987 89996 285f82 GetModuleHandleW 89998 285fc1 89996->89998 89999 285f95 GetProcAddress 89996->89999 90000 285f2f 89997->90000 90006 286440 27 API calls 89998->90006 89999->89998 90001 285fa7 GetCurrentProcess 89999->90001 90002 285f45 90000->90002 90037 27aad0 28 API calls 4 library calls 90000->90037 90001->89998 90002->89991 90002->89996 90002->90008 90020 286166 _Mpunct 90004->90020 90042 2867b0 12 API calls _Mpunct 90004->90042 90009 286022 90006->90009 90007 2860f4 90014 28610e SysFreeString 90007->90014 90017 28611b _Mpunct 90007->90017 90008->89996 90038 2636db 27 API calls collate 90009->90038 90010 2dd60f 11 API calls 90011 2861d9 90010->90011 90013 28602a 90039 26372a 5 API calls collate 90013->90039 90014->90017 90015 2861b4 _Mpunct 90015->89887 90018 286159 SysFreeString 90017->90018 90017->90020 90018->90020 90019 286032 90040 26372a 5 API calls collate 90019->90040 90020->90010 90020->90015 90022 28603a 90041 26372a 5 API calls collate 90022->90041 90024 286042 90025 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 90024->90025 90026 286059 90025->90026 90026->89887 90028 2d8367 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 90027->90028 90029 286355 90028->90029 90029->89897 90030->89897 90031->89909 90032->89903 90033->89899 90035->89966 90036->89987 90037->90002 90038->90013 90039->90019 90040->90022 90041->90024 90042->90007 90043 2b4db8 90045 2b4da7 90043->90045 90044 2c293c ___delayLoadHelper2@8 16 API calls 90044->90045 90045->90043 90045->90044 90046 2f61fa 90047 2f6206 __FrameHandler3::FrameUnwindToState 90046->90047 90048 2f620c 90047->90048 90049 2f6223 90047->90049 90050 2dd73d __Wcrtomb 14 API calls 90048->90050 90057 2e582c EnterCriticalSection 90049->90057 90056 2f6211 __cftof 90050->90056 90052 2f6233 90058 2f627a 90052->90058 90054 2f623f 90077 2f6270 LeaveCriticalSection ___scrt_uninitialize_crt 90054->90077 90057->90052 90059 2f629f 90058->90059 90060 2f6288 90058->90060 90062 2f2e1c __FrameHandler3::FrameUnwindToState 14 API calls 90059->90062 90061 2dd73d __Wcrtomb 14 API calls 90060->90061 90065 2f628d __cftof 90061->90065 90063 2f62a9 90062->90063 90078 2f6972 90063->90078 90065->90054 90067 2f638c 90069 2f639a 90067->90069 90073 2f6365 90067->90073 90068 2f6337 90071 2f6351 90068->90071 90068->90073 90070 2dd73d __Wcrtomb 14 API calls 90069->90070 90076 2f62ee __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 90070->90076 90081 2f65bd 24 API calls 4 library calls 90071->90081 90073->90076 90082 2f63fe 18 API calls 2 library calls 90073->90082 90074 2f635d 90074->90076 90076->90054 90077->90056 90083 2f67ea 90078->90083 90080 2f62c4 90080->90067 90080->90068 90080->90076 90081->90074 90082->90076 90084 2f67f6 __FrameHandler3::FrameUnwindToState 90083->90084 90085 2f67fe 90084->90085 90086 2f6816 90084->90086 90107 2dd72a 14 API calls __Wcrtomb 90085->90107 90088 2f68c7 90086->90088 90092 2f684b 90086->90092 90110 2dd72a 14 API calls __Wcrtomb 90088->90110 90089 2f6803 90091 2dd73d __Wcrtomb 14 API calls 90089->90091 90096 2f680b __cftof 90091->90096 90106 2face1 EnterCriticalSection 90092->90106 90093 2f68cc 90095 2dd73d __Wcrtomb 14 API calls 90093->90095 90095->90096 90096->90080 90097 2f6851 90098 2f688a 90097->90098 90099 2f6875 90097->90099 90100 2f68f6 __wsopen_s 16 API calls 90098->90100 90101 2dd73d __Wcrtomb 14 API calls 90099->90101 90102 2f6885 90100->90102 90103 2f687a 90101->90103 90109 2f68bf LeaveCriticalSection __wsopen_s 90102->90109 90108 2dd72a 14 API calls __Wcrtomb 90103->90108 90106->90097 90107->90089 90108->90102 90109->90096 90110->90093 90111 2e22d9 90112 2e22fc 90111->90112 90113 2e22e9 90111->90113 90115 2e230e 90112->90115 90119 2e2321 90112->90119 90114 2dd73d __Wcrtomb 14 API calls 90113->90114 90137 2e22ee __cftof __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 90114->90137 90116 2dd73d __Wcrtomb 14 API calls 90115->90116 90116->90137 90117 2e2352 90138 2f3ead 90117->90138 90118 2e2341 90120 2dd73d __Wcrtomb 14 API calls 90118->90120 90119->90117 90119->90118 90120->90137 90124 2e2369 90125 2e255d 90124->90125 90145 2f349f 14 API calls 2 library calls 90124->90145 90126 2dd62c __Getcoll 11 API calls 90125->90126 90129 2e2567 90126->90129 90128 2e237b 90128->90125 90146 2f34cb 90128->90146 90131 2e238d 90131->90125 90132 2e2396 90131->90132 90133 2e241b 90132->90133 90134 2e23b7 90132->90134 90133->90137 90152 2f3f0a 25 API calls 2 library calls 90133->90152 90134->90137 90151 2f3f0a 25 API calls 2 library calls 90134->90151 90139 2f3eb9 __FrameHandler3::FrameUnwindToState 90138->90139 90140 2e2357 90139->90140 90153 2ecd41 EnterCriticalSection 90139->90153 90144 2f3473 14 API calls 2 library calls 90140->90144 90142 2f3eca 90154 2f3f01 LeaveCriticalSection std::_Lockit::~_Lockit 90142->90154 90144->90124 90145->90128 90147 2f34ec 90146->90147 90148 2f34d7 90146->90148 90147->90131 90149 2dd73d __Wcrtomb 14 API calls 90148->90149 90150 2f34dc __cftof 90149->90150 90150->90131 90151->90137 90152->90137 90153->90142 90154->90140 90161 28ea50 90164 28ed10 90161->90164 90162 28ea63 90165 28ed39 90164->90165 90166 28ed1a 90164->90166 90165->90162 90166->90165 90167 28ed22 RegSetValueExW 90166->90167 90167->90162 90168 28ecd0 90169 28ecde 90168->90169 90170 28ece7 lstrlenW 90168->90170 90172 28ed10 RegSetValueExW 90170->90172 90171 28ed07 90172->90171 90173 28df10 RegCreateKeyExW 90174 28df52 90173->90174 90178 28e590 90179 28e59a 90178->90179 90180 28e5a5 90178->90180 90183 28e8c0 RegQueryValueExW 90180->90183 90181 28e5bf 90183->90181 90187 2f5192 90188 2f2e1c __FrameHandler3::FrameUnwindToState 14 API calls 90187->90188 90189 2f51a0 90188->90189 90190 2f51af 90189->90190 90191 2f51ce 90189->90191 90194 2dd73d __Wcrtomb 14 API calls 90190->90194 90192 2f51dc 90191->90192 90193 2f51e9 90191->90193 90195 2dd73d __Wcrtomb 14 API calls 90192->90195 90200 2f51fc 90193->90200 90220 2f555a 16 API calls __wsopen_s 90193->90220 90199 2f51b4 90194->90199 90195->90199 90197 2f527b 90209 2f53c0 90197->90209 90200->90197 90200->90199 90201 2fec2a __wsopen_s 14 API calls 90200->90201 90202 2f526e 90200->90202 90201->90202 90202->90197 90204 2f55f5 90202->90204 90205 2f2174 __cftoe 15 API calls 90204->90205 90206 2f5610 90205->90206 90207 2f2098 _free 14 API calls 90206->90207 90208 2f561a 90207->90208 90208->90197 90210 2f2e1c __FrameHandler3::FrameUnwindToState 14 API calls 90209->90210 90211 2f53cf 90210->90211 90212 2f5472 90211->90212 90213 2f53e2 90211->90213 90214 2f5ee6 __wsopen_s 68 API calls 90212->90214 90215 2f53ff 90213->90215 90218 2f5423 90213->90218 90217 2f540c 90214->90217 90216 2f5ee6 __wsopen_s 68 API calls 90215->90216 90216->90217 90217->90199 90218->90217 90219 2f6972 18 API calls 90218->90219 90219->90217 90220->90200

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00293AC0 Relevance: 75.4, APIs: 3, Strings: 39, Instructions: 1934COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::locale::_Init.LIBCPMT ref: 00293CE8
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: __EH_prolog3.LIBCMT ref: 002C308B
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::_Lockit::_Lockit.LIBCPMT ref: 002C3096
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::locale::_Setgloballocale.LIBCPMT ref: 002C30B1
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::_Lockit::~_Lockit.LIBCPMT ref: 002C3107
                                                                                                                                                                                                                                              • std::locale::_Init.LIBCPMT ref: 00294934
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00294CD5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::locale::_$InitLockitstd::_$H_prolog3Ios_base_dtorLockit::_Lockit::~_Setgloballocalestd::ios_base::_
                                                                                                                                                                                                                                              • String ID: $+2$$+2$2$Command "%s" failed$Couldn't find the ReturnCode attribute of EXIT command$EXIT$EXIT_UPDATE$EXIT_XML$Exit update command triggered. Exiting...$Malformed XML, no UPDATEARRAY element$NWebAdvisor::NXmlUpdater::CUpdater::Process$NWebAdvisor::NXmlUpdater::Hound::End$NWebAdvisor::NXmlUpdater::Hound::ExitResult$NWebAdvisor::NXmlUpdater::Hound::Start$PRECONDITION$PRECONDITIONARRAY$Precondition "%s" evaluated to false$Precondition "%s" evaluated to true$ReturnCode$TAG$UPDATE$UPDATEARRAY$UPDATECOMMANDS$Unable to convert ReturnCode into int$Unable to substitute the return code$XML precondition array returned false due to sniffer actions$XML precondition array returned true due to sniffer actions$XML precondition array with tag %s returned false$XML precondition array with tag %s returned false due to sniffer actions$XML precondition array with tag %s returned true due to sniffer actions$XML precondition failed - no Type specified$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.h$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\xmlUpdater.cpp$false$true$unknown$*2$*2$+2
                                                                                                                                                                                                                                              • API String ID: 3544396713-3634558477
                                                                                                                                                                                                                                              • Opcode ID: af378b78f1f0940e98b370d426ac0ca08b17da44f92074632d1ae392c9838dd6
                                                                                                                                                                                                                                              • Instruction ID: df2ceb30cd03d44d4676ae9c50776502d251e6c47c5696da56413ab89d4ef841
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: af378b78f1f0940e98b370d426ac0ca08b17da44f92074632d1ae392c9838dd6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C613AC75D112299BDF21DF64CC89BEEB7B4AF04304F1482D9E809A7291DB70AE95CF90
                                                                                                                                                                                                                                              Function 0027F110 Relevance: 75.3, APIs: 21, Strings: 21, Instructions: 1782COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027F268
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027F307
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027F37E
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027F8B0
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027FBBD
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027FDB6
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002800BA
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0028015F
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 002805D7
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00280614
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 0028086A
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002808A7
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001,0000018F,00000000,X-Api-Key: ,0000000B,00000000,00000000,?,?,00000004), ref: 00280A90
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00280ACD
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$ErrorLast$InitOnce$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID: 0Ywx4MUvRidmWf74nsIlBPIxJYIG9Nf0lSnge8SvgvY3RVy4E6gFLp3VDBcDO830QhXvfpgCb55sRtnVqKb2zUO3Vq7ko1b$AWS Adhoc Telemetry Payload = $AWS Response Code received $AdhocTelemetryAWS$Failed to convert the x_api_key string to wide$Failed to initialize buffer for AWS$HTTP add request header failed for AWS x_api_key: $HTTP connection failed for AWS: $HTTP open request failed for AWS: $HTTP receive response failed for AWS: $HTTP send request failed for AWS: $HTTP status error for AWS: $NO_REGVALUE$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor$X-Api-Key: $`ato$`3$`3$`3$`3
                                                                                                                                                                                                                                              • API String ID: 1658547907-2639375374
                                                                                                                                                                                                                                              • Opcode ID: dcd018c7eaa4a16dcd7326eac2bbfe8567dd487e76f0a4c8fb2b91510bdec71e
                                                                                                                                                                                                                                              • Instruction ID: 7d4b415792f89cd06b0b54c9e4e3b5bec8005fb094836f91b9e3072e70be7bfb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dcd018c7eaa4a16dcd7326eac2bbfe8567dd487e76f0a4c8fb2b91510bdec71e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54F2DE709212689BDB65EF24CD89BDDB7B9AF45304F0081D8E40DA7292DB759EE8CF40
                                                                                                                                                                                                                                              Function 00285318 Relevance: 72.7, APIs: 12, Strings: 29, Instructions: 928COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1169 285318-28532c call 2d88fa 1172 28571d-285b7a call 286440 GetModuleHandleW call 286440 call 2865c0 call 286440 * 2 call 279180 1169->1172 1173 285332-2853a2 call 2d8713 call 284a40 1169->1173 1231 285b7f-285b81 1172->1231 1232 285b7a call 279180 1172->1232 1180 2853a7-28571a call 284a40 * 2 call 2861f0 call 2d85d4 call 284a40 * 3 call 2861f0 call 2d85d4 call 284a40 * 3 call 2861f0 call 2d85d4 call 284a40 * 3 call 2861f0 call 2d85d4 call 2d8713 call 2d85bf call 2d88b0 1173->1180 1180->1172 1234 285b83-285b8d 1231->1234 1235 285bc4-285be0 call 2611f3 1231->1235 1232->1231 1238 285c8d-285ccd call 286440 1234->1238 1239 285b93-285ba5 1234->1239 1247 285cfc-285d06 1235->1247 1248 285be6-285c59 call 269bb0 call 269940 call 261b84 call 261be0 call 26b8a0 call 2c2bfd 1235->1248 1255 285db3-285dc0 1238->1255 1256 285cd3-285cd8 1238->1256 1240 285bab-285bbf 1239->1240 1241 285c83-285c8a call 2d8375 1239->1241 1240->1241 1241->1238 1251 285d08-285d1a 1247->1251 1252 285d3a-285d67 call 286440 1247->1252 1248->1238 1341 285c5b-285c6d 1248->1341 1259 285d1c-285d2a 1251->1259 1260 285d30-285d37 call 2d8375 1251->1260 1277 285d78-285d82 1252->1277 1278 285d69-285d73 call 27aad0 1252->1278 1265 285dc9-285dce 1255->1265 1266 285dc2-285dc7 1255->1266 1263 285cda 1256->1263 1264 285cdc-285cf7 call 2da3a0 1256->1264 1259->1260 1260->1252 1263->1264 1289 285e8e-285e98 1264->1289 1267 285dd1-285de5 1265->1267 1266->1267 1273 285e30-285e32 1267->1273 1274 285de7-285dec 1267->1274 1284 285e64-285e86 1273->1284 1285 285e34-285e62 call 2d8713 1273->1285 1281 285df2-285dfd call 2d8713 1274->1281 1282 286085 Concurrency::cancel_current_task 1274->1282 1277->1238 1288 285d88-285d94 1277->1288 1278->1277 1290 28608a call 2dd60f 1281->1290 1311 285e03-285e2e 1281->1311 1282->1290 1295 285e8c 1284->1295 1285->1295 1288->1241 1296 285d9a-285dae 1288->1296 1297 285e9a-285ea6 1289->1297 1298 285ec6-285ee7 call 279980 1289->1298 1309 28608f-2860aa call 2dd60f 1290->1309 1295->1289 1296->1241 1306 285ea8-285eb6 1297->1306 1307 285ebc-285ec3 call 2d8375 1297->1307 1310 285eec-285eee 1298->1310 1306->1290 1306->1307 1307->1298 1328 2860d8-2860fc call 2867b0 1309->1328 1329 2860ac-2860b6 1309->1329 1316 285f7f 1310->1316 1317 285ef4-285f34 call 286440 1310->1317 1311->1295 1320 285f82-285f93 GetModuleHandleW 1316->1320 1336 285f45-285f4f 1317->1336 1337 285f36-285f40 call 27aad0 1317->1337 1326 285fd1 1320->1326 1327 285f95-285fa5 GetProcAddress 1320->1327 1339 285fd3-28605c call 286440 call 2636db call 26372a * 3 call 2d8367 1326->1339 1327->1326 1333 285fa7-285fc5 GetCurrentProcess 1327->1333 1358 2860fe-286106 1328->1358 1359 286144-286149 1328->1359 1334 2860b8-2860c6 1329->1334 1335 2860ce-2860d5 call 2d8375 1329->1335 1333->1326 1382 285fc7-285fcb 1333->1382 1342 2860cc 1334->1342 1343 2861d4-2861d9 call 2dd60f 1334->1343 1335->1328 1336->1320 1347 285f51-285f5d 1336->1347 1337->1336 1341->1241 1350 285c6f-285c7d 1341->1350 1342->1335 1354 285f5f-285f6d 1347->1354 1355 285f73-285f7d call 2d8375 1347->1355 1350->1241 1354->1309 1354->1355 1355->1320 1361 286108-28610c 1358->1361 1362 28613d 1358->1362 1363 28614b-286151 1359->1363 1364 28618f-286197 1359->1364 1370 28611b-286120 1361->1370 1371 28610e-286115 SysFreeString 1361->1371 1362->1359 1375 286188 1363->1375 1376 286153-286157 1363->1376 1372 286199-2861a2 1364->1372 1373 2861c0-2861d3 1364->1373 1378 286132-28613a call 2d8375 1370->1378 1379 286122-28612b call 2d874c 1370->1379 1371->1370 1380 2861a4-2861b2 1372->1380 1381 2861b6-2861bd call 2d8375 1372->1381 1375->1364 1383 286159-286160 SysFreeString 1376->1383 1384 286166-28616b 1376->1384 1378->1362 1379->1378 1380->1343 1388 2861b4 1380->1388 1381->1373 1382->1326 1389 285fcd-285fcf 1382->1389 1383->1384 1391 28617d-286185 call 2d8375 1384->1391 1392 28616d-286176 call 2d874c 1384->1392 1388->1381 1389->1339 1391->1375 1392->1391
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002D88FA: EnterCriticalSection.KERNEL32(0035742C,?,?,?,0027402B,0035827C,1CE34B5F,?,00271171,?), ref: 002D8905
                                                                                                                                                                                                                                                • Part of subcall function 002D88FA: LeaveCriticalSection.KERNEL32(0035742C,?,?,?,0027402B,0035827C,1CE34B5F,?,00271171,?), ref: 002D8942
                                                                                                                                                                                                                                                • Part of subcall function 00284A40: _com_issue_error.COMSUPP ref: 00284AD2
                                                                                                                                                                                                                                                • Part of subcall function 00284A40: SysFreeString.OLEAUT32(-00000001), ref: 00284AFD
                                                                                                                                                                                                                                                • Part of subcall function 002861F0: Concurrency::cancel_current_task.LIBCPMT ref: 002862BF
                                                                                                                                                                                                                                                • Part of subcall function 002D88B0: EnterCriticalSection.KERNEL32(0035742C,?,?,00274086,0035827C,003168E0,?), ref: 002D88BA
                                                                                                                                                                                                                                                • Part of subcall function 002D88B0: LeaveCriticalSection.KERNEL32(0035742C,?,?,00274086,0035827C,003168E0,?), ref: 002D88ED
                                                                                                                                                                                                                                                • Part of subcall function 002D88B0: RtlWakeAllConditionVariable.NTDLL ref: 002D8964
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,1CE34B5F,?,?), ref: 002857B4
                                                                                                                                                                                                                                              • FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 002857C5
                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00000000,00000000), ref: 002857D1
                                                                                                                                                                                                                                              • LockResource.KERNEL32(00000000), ref: 002857DC
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00286067
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00286085
                                                                                                                                                                                                                                              • SysFreeString.OLEAUT32 ref: 0028610F
                                                                                                                                                                                                                                              • SysFreeString.OLEAUT32(00000000), ref: 0028615A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CriticalSection$Concurrency::cancel_current_taskFreeResourceString$EnterLeave$ConditionFindHandleLoadLockModuleVariableWake_com_issue_error
                                                                                                                                                                                                                                              • String ID: (error)$)$0.0.0.0$03$4.1.1.865$43$EstimatedRunTime$Failed to convert wuuid to string$IsWow64Process$NO_REGKEY$PCSystemTypeEx$PowerState$PredictFailure$Root\CIMV2$Time$UUID$UUID$Version$ery)$kState$kernel32$kernel32.dll$orm$root\wmi$select EstimatedRunTime from Win32_Battery$select PCSystemTypeEx from Win32_ComputerSystem$select PowerState from Win32_ComputerSystem$select PredictFailure from MSStorageDriver_FailurePredictStatus$t
                                                                                                                                                                                                                                              • API String ID: 2830066208-2059983550
                                                                                                                                                                                                                                              • Opcode ID: c5e61dfd63bd9f31fed289c724bfc16dc5d954b5d302faaf156245ef4e678b72
                                                                                                                                                                                                                                              • Instruction ID: b5941e0c8e5de44b03b782519dac607866bb52f1282aafc09fcd045efb380bb2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c5e61dfd63bd9f31fed289c724bfc16dc5d954b5d302faaf156245ef4e678b72
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 928235789213449FEB16EFA4DC897ADBBB9AF45300F24410CE404AB3E2DB749A94CF51
                                                                                                                                                                                                                                              Function 00275870 Relevance: 60.3, APIs: 22, Strings: 12, Instructions: 780encryptionfilethreadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1938 275870-2758d0 GetCurrentProcessId GetCurrentThreadId call 2e594f 1941 2758d6-275943 CreateFileW 1938->1941 1942 276170-276185 call 26c900 1938->1942 1943 275945-275965 CreateFileW 1941->1943 1944 27596f-275973 1941->1944 1950 276187-276189 1942->1950 1951 2761a5-2761ab 1942->1951 1943->1944 1946 275967-27596d 1943->1946 1948 275975 1944->1948 1949 27597a-27599c CreateFileW 1944->1949 1946->1948 1948->1949 1952 275a05-275a49 call 2da920 UuidCreate 1949->1952 1953 27599e-2759c0 CreateFileW 1949->1953 1950->1951 1957 27618b-27618e 1950->1957 1955 2761be-2761c4 1951->1955 1956 2761ad-2761ba 1951->1956 1964 275a4f-275a5f UuidCreate 1952->1964 1965 27620b-27621b call 26c900 1952->1965 1953->1952 1958 2759c2-2759e4 CreateFileW 1953->1958 1960 2761d7-2761dd 1955->1960 1961 2761c6-2761d3 1955->1961 1956->1955 1957->1951 1962 276190-276194 1957->1962 1958->1952 1963 2759e6-275a03 CreateFileW 1958->1963 1967 2761f0-276206 call 2d8367 1960->1967 1968 2761df-2761ec 1960->1968 1961->1960 1962->1951 1969 276196-27619a 1962->1969 1963->1952 1964->1965 1971 275a65-275a87 call 275790 1964->1971 1965->1957 1968->1967 1969->1951 1974 27619c-2761a3 call 2769a0 1969->1974 1982 275aea-275af2 1971->1982 1983 275a89 1971->1983 1974->1951 1982->1965 1984 275af8-275b30 1982->1984 1985 275a90-275a96 1983->1985 2002 276207 1984->2002 2003 275b36-275b3e 1984->2003 1986 275a9f-275aa5 1985->1986 1987 275a98-275a9d 1985->1987 1990 275aa7-275aac 1986->1990 1991 275aae-275ab4 1986->1991 1989 275ad9-275ae1 call 275790 1987->1989 1995 275ae6-275ae8 1989->1995 1990->1989 1993 275ab6-275abb 1991->1993 1994 275abd-275ac3 1991->1994 1993->1989 1997 275ac5-275aca 1994->1997 1998 275acc-275ad2 1994->1998 1995->1982 1995->1985 1997->1989 1998->1982 1999 275ad4 1998->1999 1999->1989 2002->1965 2003->2002 2004 275b44-275b5c 2003->2004 2004->2002 2007 275b62-275b66 2004->2007 2007->2002 2008 275b6c-275c01 call 274cc0 2007->2008 2008->2002 2021 275c07-275c4a 2008->2021 2026 275c50-275c54 2021->2026 2027 27616c 2021->2027 2026->2027 2028 275c5a-275c74 2026->2028 2027->1942 2028->2027 2031 275c7a-275c7e 2028->2031 2031->2027 2032 275c84-275cd4 call 274cc0 2031->2032 2039 275cd7-275ce0 2032->2039 2039->2039 2040 275ce2-275d16 CryptAcquireContextW 2039->2040 2041 275d65-275d6b 2040->2041 2042 275d18-275d32 CryptCreateHash 2040->2042 2044 275d74-275d7a 2041->2044 2045 275d6d-275d6e CryptDestroyHash 2041->2045 2042->2041 2043 275d34-275d4b CryptHashData 2042->2043 2043->2041 2048 275d4d-275d5f CryptGetHashParam 2043->2048 2046 275d85-275ef5 2044->2046 2047 275d7c-275d7f CryptReleaseContext 2044->2047 2045->2044 2046->2027 2077 275efb-275f4e call 274cc0 2046->2077 2047->2046 2048->2041 2084 275f50-275f59 2077->2084 2084->2084 2085 275f5b-275f8f CryptAcquireContextW 2084->2085 2086 275f91-275fab CryptCreateHash 2085->2086 2087 275fde-275fe4 2085->2087 2086->2087 2088 275fad-275fc4 CryptHashData 2086->2088 2089 275fe6-275fe7 CryptDestroyHash 2087->2089 2090 275fed-275ff3 2087->2090 2088->2087 2091 275fc6-275fd8 CryptGetHashParam 2088->2091 2089->2090 2092 275ff5-275ff8 CryptReleaseContext 2090->2092 2093 275ffe-276166 2090->2093 2091->2087 2092->2093 2093->2027
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 002758AA
                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 002758B4
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 0027593A
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 0027595C
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(\\.\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 00275991
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(\\.\Global\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 002759B5
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 002759D9
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 002759FD
                                                                                                                                                                                                                                              • UuidCreate.RPCRT4(00000000), ref: 00275A41
                                                                                                                                                                                                                                              • UuidCreate.RPCRT4(00000000), ref: 00275A57
                                                                                                                                                                                                                                              • CryptAcquireContextW.ADVAPI32(?), ref: 00275D0E
                                                                                                                                                                                                                                              • CryptCreateHash.ADVAPI32(00000010,00008003,00000000,00000000,?), ref: 00275D2A
                                                                                                                                                                                                                                              • CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 00275D43
                                                                                                                                                                                                                                              • CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 00275D5F
                                                                                                                                                                                                                                              • CryptDestroyHash.ADVAPI32(?), ref: 00275D6E
                                                                                                                                                                                                                                              • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00275D7F
                                                                                                                                                                                                                                              • CryptAcquireContextW.ADVAPI32(?), ref: 00275F87
                                                                                                                                                                                                                                              • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 00275FA3
                                                                                                                                                                                                                                              • CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 00275FBC
                                                                                                                                                                                                                                              • CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 00275FD8
                                                                                                                                                                                                                                              • CryptDestroyHash.ADVAPI32(?), ref: 00275FE7
                                                                                                                                                                                                                                              • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00275FF8
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Crypt$Create$Hash$File$Context$AcquireCurrentDataDestroyParamReleaseUuid$ProcessThread
                                                                                                                                                                                                                                              • String ID: AacControl$AacControl2$AacControl3$AacControl4$AacControl5$AacControl6$Created access handle %p$\\.\Global\WGUARDNT$\\.\WGUARDNT$accesslib policy %x:%x$al delete policy on terminate process 0x%x (%d) rule$al disable rules on terminate thread 0x%x (%d) rule
                                                                                                                                                                                                                                              • API String ID: 4128897270-3926088020
                                                                                                                                                                                                                                              • Opcode ID: 75f844e361783e79b7752dd029bd2f0f01c15480ec9b0c1c361bbd81168c77b7
                                                                                                                                                                                                                                              • Instruction ID: 0bd61b3561ec336200bee5d71b32b0a22834ed306b2fa74eb998ac405e6de3ca
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75f844e361783e79b7752dd029bd2f0f01c15480ec9b0c1c361bbd81168c77b7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F5268396103119FDB119F24C898B6EB7E9BF8C710F194959FA59A7390CBB1ED018F82
                                                                                                                                                                                                                                              Function 002B1840 Relevance: 60.3, APIs: 5, Strings: 29, Instructions: 754registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegCreateKeyExW.KERNEL32(80000002,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,-00000028,?,?,-00000028,00000000,?), ref: 002B1932
                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000028,?), ref: 002B1DAD
                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(00000000,?,?,?,-00000028,?,?,-00000028,00000000,?), ref: 002B1DD3
                                                                                                                                                                                                                                              • std::locale::_Init.LIBCPMT ref: 002B20C4
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Close$CreateInitstd::locale::_
                                                                                                                                                                                                                                              • String ID: to $$+2$(Default)$BIN$DWORD$Error (%d) creating registry key: %s$Error (%d) setting value (%s) under registry key: %s$Key$NUM$NWebAdvisor::NXmlUpdater::CSetVariableCommand::Execute$NWebAdvisor::NXmlUpdater::SetRegistryKey$QWORD$STR$Setting variable $Unable to convert %s to hex$Unable to read key or value attribute of SETVAR command$Unable to set the variable$Unable to substitute variables for the SETVAR command$Unknown registry key type: %s$Value$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\RegistryCommand.cpp$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SetVariableCommand.cpp$invalid stoul argument$invalid stoull argument$invalid substitutor$memcpy_s failed in NWebAdvisor::NXmlUpdater::SetRegistryKey$stoul argument out of range$stoull argument out of range$*2
                                                                                                                                                                                                                                              • API String ID: 3662814871-3063851640
                                                                                                                                                                                                                                              • Opcode ID: b194e2f1f396301cc3debdcf78229e66fbf9d2977c847711ffca09da73678348
                                                                                                                                                                                                                                              • Instruction ID: 49711f5e68913cdea4b33aaacab0c4ffa6ea7889926b445f30fe27ae7bf071e2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b194e2f1f396301cc3debdcf78229e66fbf9d2977c847711ffca09da73678348
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2C52FF70A20319DBEB20DF54DC95BDEB7B4AF04744F540199E809AB381D771AAA4CFA1
                                                                                                                                                                                                                                              Function 002C17A0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 353encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 3020 2c17a0-2c17e9 3021 2c184f 3020->3021 3022 2c17eb-2c181d CryptQueryObject 3020->3022 3025 2c1851-2c186c call 2d8367 3021->3025 3023 2c186d-2c18ae call 2c14f0 3022->3023 3024 2c181f-2c1824 3022->3024 3034 2c18e4-2c18ea 3023->3034 3035 2c18b0-2c18bd call 2ae680 3023->3035 3027 2c182d-2c1832 3024->3027 3028 2c1826-2c1827 CryptMsgClose 3024->3028 3031 2c1834-2c183f CertCloseStore 3027->3031 3032 2c1842-2c1848 3027->3032 3028->3027 3031->3032 3032->3021 3036 2c184a-2c184b 3032->3036 3038 2c18f0-2c18f6 3034->3038 3042 2c18bf-2c18c0 CryptMsgClose 3035->3042 3043 2c18c6-2c18cb 3035->3043 3036->3021 3040 2c18fc-2c1944 3038->3040 3041 2c1b40-2c1b4d call 2ae680 3038->3041 3045 2c198e-2c19d5 CryptQueryObject 3040->3045 3046 2c1946-2c1951 3040->3046 3059 2c1b4f-2c1b50 CryptMsgClose 3041->3059 3060 2c1b52-2c1b57 3041->3060 3042->3043 3049 2c18cd-2c18d8 CertCloseStore 3043->3049 3050 2c18db-2c18df 3043->3050 3047 2c1a39-2c1a5c call 2c14f0 3045->3047 3048 2c19d7-2c19dc 3045->3048 3052 2c1969-2c198b call 2d8375 3046->3052 3053 2c1953-2c1961 3046->3053 3073 2c1a5e-2c1a60 3047->3073 3074 2c1ac8-2c1aca 3047->3074 3055 2c19de-2c19df CryptMsgClose 3048->3055 3056 2c19e1-2c19ec 3048->3056 3049->3050 3058 2c1ab8-2c1aba 3050->3058 3052->3045 3061 2c1b7c-2c1b81 call 2dd60f 3053->3061 3062 2c1967 3053->3062 3055->3056 3065 2c19ee-2c19f5 CertCloseStore 3056->3065 3066 2c19f8-2c19fe 3056->3066 3068 2c1abc-2c1abd 3058->3068 3069 2c1ac1-2c1ac3 3058->3069 3059->3060 3070 2c1b59-2c1b64 CertCloseStore 3060->3070 3071 2c1b67 3060->3071 3062->3052 3065->3066 3075 2c1a05-2c1a1a call 2ae630 call 2ae680 3066->3075 3076 2c1a00-2c1a01 3066->3076 3068->3069 3069->3025 3070->3071 3071->3061 3077 2c1a65-2c1a70 3073->3077 3078 2c1a62-2c1a63 CryptMsgClose 3073->3078 3080 2c1acc-2c1acd CryptMsgClose 3074->3080 3081 2c1acf-2c1ad4 3074->3081 3095 2c1a1c-2c1a1d CryptMsgClose 3075->3095 3096 2c1a1f-2c1a24 3075->3096 3076->3075 3082 2c1a7c-2c1a82 3077->3082 3083 2c1a72-2c1a79 CertCloseStore 3077->3083 3078->3077 3080->3081 3085 2c1ae4-2c1aea 3081->3085 3086 2c1ad6-2c1ae1 CertCloseStore 3081->3086 3089 2c1a89-2c1a9e call 2ae630 call 2ae680 3082->3089 3090 2c1a84-2c1a85 3082->3090 3083->3082 3087 2c1aec-2c1aed 3085->3087 3088 2c1af1-2c1af7 3085->3088 3086->3085 3087->3088 3088->3038 3093 2c1afd-2c1b08 3088->3093 3107 2c1aa0-2c1aa1 CryptMsgClose 3089->3107 3108 2c1aa3-2c1aa8 3089->3108 3090->3089 3098 2c1b1c-2c1b3b call 2d8375 3093->3098 3099 2c1b0a-2c1b18 3093->3099 3095->3096 3100 2c1a26-2c1a2d CertCloseStore 3096->3100 3101 2c1a30 3096->3101 3098->3038 3099->3061 3103 2c1b1a 3099->3103 3100->3101 3101->3047 3103->3098 3107->3108 3109 2c1aaa-2c1ab1 CertCloseStore 3108->3109 3110 2c1ab4 3108->3110 3109->3110 3110->3058
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CryptQueryObject.CRYPT32(00000001, %,,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C1815
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C1827
                                                                                                                                                                                                                                                • Part of subcall function 002C14F0: CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 002C1581
                                                                                                                                                                                                                                                • Part of subcall function 002C14F0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 002C15B2
                                                                                                                                                                                                                                                • Part of subcall function 002C14F0: CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 002C15DD
                                                                                                                                                                                                                                                • Part of subcall function 002C14F0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 002C1625
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C1837
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C18C0
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C18D0
                                                                                                                                                                                                                                              • CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C19CD
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C19DF
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C19F1
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C1A1D
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C1A29
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C1A63
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C1A75
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C1AA1
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C1AAD
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C1ACD
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C1AD9
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002C1B50
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002C1B5C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
                                                                                                                                                                                                                                              • String ID: %,
                                                                                                                                                                                                                                              • API String ID: 2648890560-489104374
                                                                                                                                                                                                                                              • Opcode ID: 398a29fbd875fb92faebd66d9beab54ff6e0562afe3879f7c69255cfb24270d0
                                                                                                                                                                                                                                              • Instruction ID: a5adbf5de5fceac18a5103bc5f5af7f7c5c9e49b8fcb626ecf126136b7f7b8ef
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 398a29fbd875fb92faebd66d9beab54ff6e0562afe3879f7c69255cfb24270d0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 53C11C71E20249ABEF10CFA5CD86FAEBBB8AF05704F144659E504F7281EB75D914CBA0
                                                                                                                                                                                                                                              Function 002AFFE0 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 368COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 3111 2affe0-2b002d 3112 2b002f-2b004c call 298650 3111->3112 3113 2b0051-2b0055 3111->3113 3122 2b0557-2b0571 call 2d8367 3112->3122 3115 2b00ae-2b010d 3113->3115 3116 2b0057-2b005d 3113->3116 3120 2b010f-2b011b 3115->3120 3121 2b0122-2b0135 3115->3121 3118 2b005f 3116->3118 3119 2b0061-2b006a 3116->3119 3118->3119 3123 2b006c-2b0073 call 2c21d0 3119->3123 3124 2b0077-2b007c call 2aeb20 3119->3124 3120->3121 3125 2b013b-2b0145 3121->3125 3126 2b0574-2b0579 call 2634d0 3121->3126 3137 2b0075 3123->3137 3140 2b007f-2b0081 3124->3140 3130 2b014f-2b0187 3125->3130 3131 2b0147-2b0149 3125->3131 3135 2b0189-2b0194 3130->3135 3136 2b01d3-2b0283 call 2da3a0 call 26e9c0 3130->3136 3131->3130 3138 2b019d-2b01a4 3135->3138 3139 2b0196-2b019b 3135->3139 3153 2b0287-2b0318 call 26e9c0 call 2638d0 * 2 call 2da920 3136->3153 3154 2b0285 3136->3154 3137->3140 3142 2b01a7-2b01cd call 2633c3 3138->3142 3139->3142 3140->3115 3143 2b0083-2b0087 3140->3143 3142->3136 3146 2b008b-2b00a9 call 298650 3143->3146 3147 2b0089 3143->3147 3146->3122 3147->3146 3163 2b0320-2b0328 3153->3163 3154->3153 3164 2b032a-2b0331 3163->3164 3165 2b033e-2b0355 3163->3165 3164->3165 3166 2b0333-2b033c 3164->3166 3167 2b0359-2b0383 CreateProcessW 3165->3167 3168 2b0357 3165->3168 3166->3163 3166->3165 3169 2b03ba-2b03ca WaitForSingleObject 3167->3169 3170 2b0385-2b03b5 GetLastError call 298650 3167->3170 3168->3167 3172 2b03de-2b03fd GetExitCodeProcess 3169->3172 3173 2b03cc-2b03d0 3169->3173 3182 2b0526-2b053f call 2638d0 3170->3182 3174 2b03ff-2b040b GetLastError 3172->3174 3175 2b0430-2b0434 3172->3175 3177 2b03d2 3173->3177 3178 2b03d4-2b03dc 3173->3178 3179 2b0410-2b042b call 298650 3174->3179 3180 2b046e-2b0477 3175->3180 3181 2b0436-2b043a 3175->3181 3177->3178 3178->3179 3179->3182 3187 2b0480-2b049e 3180->3187 3184 2b043e-2b0447 DeleteFileW 3181->3184 3185 2b043c 3181->3185 3195 2b0541-2b0542 CloseHandle 3182->3195 3196 2b0544-2b054c 3182->3196 3184->3180 3189 2b0449-2b046b GetLastError call 298650 3184->3189 3185->3184 3187->3187 3191 2b04a0-2b04c4 3187->3191 3189->3180 3192 2b04d7-2b051f call 2614a1 call 29a350 call 2638d0 * 2 3191->3192 3193 2b04c6-2b04d2 call 26347e 3191->3193 3192->3182 3193->3192 3195->3196 3198 2b054e-2b054f CloseHandle 3196->3198 3199 2b0551 3196->3199 3198->3199 3199->3122
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: D$Failed to delete executable (%d)$Failed to get process exit code (%d)$NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand$Signature check failed for command %s$Unable to run %s, error (%d)$Wait for process failed for command %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExecuteLocalCommand.cpp$invalid substitutor
                                                                                                                                                                                                                                              • API String ID: 0-284121414
                                                                                                                                                                                                                                              • Opcode ID: 1c4be9e12eb2e73c9261c838314fca49208829419bb7a960f6010cca062fae86
                                                                                                                                                                                                                                              • Instruction ID: 8651b2074b50f83d71d09ca5c65f3e75d1536dd1a8fa82a6044710fc227207a7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c4be9e12eb2e73c9261c838314fca49208829419bb7a960f6010cca062fae86
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 41E1BF70E212699FDB26DF24CC89BEEB7B8BF55304F0041DAE409A7291DB709A94CF51
                                                                                                                                                                                                                                              Function 00275204 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 345registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 3384 275204-27523e RegOpenKeyExW 3385 275244-275273 RegQueryValueExW 3384->3385 3386 2752e2-275311 call 2de960 GetLastError 3384->3386 3387 275275-27527d 3385->3387 3388 2752ca-2752dc RegCloseKey 3385->3388 3391 27538b-2753dc 3386->3391 3387->3388 3390 27527f-275292 call 274c10 3387->3390 3388->3386 3388->3391 3402 2752b4-2752c8 SetLastError RegCloseKey 3390->3402 3403 275294-27529c 3390->3403 3393 2753de-2753eb OutputDebugStringW call 274f50 3391->3393 3394 2753fd-275401 3391->3394 3400 2753f0-2753f8 3393->3400 3397 275403-275449 call 2da920 * 2 call 276ae0 3394->3397 3398 27547e-275481 3394->3398 3397->3398 3439 27544b-275471 3397->3439 3404 275483-275489 3398->3404 3405 27548f-275496 3398->3405 3400->3398 3402->3386 3403->3388 3409 27529e-2752b2 call 274c10 3403->3409 3404->3405 3406 2755d1-2755d7 3404->3406 3405->3406 3407 27549c-2754b8 OutputDebugStringW call 274e60 3405->3407 3410 2755f3 3406->3410 3411 2755d9 3406->3411 3424 2754be-2754d8 call 274e60 3407->3424 3425 2755cb 3407->3425 3409->3388 3409->3402 3418 2755f5 3410->3418 3415 275703-27570a 3411->3415 3416 2755df-2755e5 3411->3416 3421 27570c-27571b LoadLibraryExW 3415->3421 3422 275739 3415->3422 3416->3415 3423 2755eb-2755f1 3416->3423 3418->3415 3426 2755fb-275606 3418->3426 3428 27573e-275743 3421->3428 3429 27571d-275737 GetLastError call 2de960 3421->3429 3422->3428 3423->3418 3441 2754f2-275516 call 2e594f 3424->3441 3442 2754da-2754e0 3424->3442 3425->3406 3431 275610-27561c call 274dc0 3426->3431 3432 275608-27560a 3426->3432 3436 275745-27574b call 2d874c 3428->3436 3437 27574e-275753 3428->3437 3429->3428 3450 275622-27562a 3431->3450 3451 2756ea-2756ef 3431->3451 3432->3431 3436->3437 3445 275755-27575b call 2d874c 3437->3445 3446 27575e-275784 call 2d8367 3437->3446 3439->3398 3448 275518-27551f 3441->3448 3447 2754e2-2754eb call 2de960 3442->3447 3442->3448 3445->3446 3447->3441 3448->3426 3461 275525-27554b call 274e60 call 274cc0 3448->3461 3450->3451 3457 275630 3450->3457 3451->3428 3458 2756f1-275701 call 2de960 3451->3458 3465 275635-275639 3457->3465 3458->3428 3476 2755c4-2755c9 3461->3476 3477 27554d-27557f call 2da920 * 2 call 276ae0 3461->3477 3468 275643-27565a 3465->3468 3469 27563b-275641 3465->3469 3468->3451 3471 275660-2756a2 call 274dc0 call 2e594f 3468->3471 3469->3465 3469->3468 3471->3451 3482 2756a4-2756e2 call 274dc0 call 274cc0 OutputDebugStringW call 2de960 3471->3482 3476->3426 3489 275584-27558d 3477->3489 3493 2756e7 3482->3493 3489->3406 3491 27558f-2755c2 3489->3491 3491->3406 3493->3451
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegOpenKeyExW.KERNEL32(80000002,Software\McAfee\SystemCore,00000000,00020219,?), ref: 00275225
                                                                                                                                                                                                                                              • RegQueryValueExW.ADVAPI32(?,szInstallDir32,00000000,?,?,?), ref: 00275265
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(0000006F,?,?,0033A17C), ref: 002752B6
                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 002752C2
                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 002752D0
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002752F6
                                                                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(NCPrivateLoadAndValidateMPTDll: Looking in current directory), ref: 002753E3
                                                                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(NCPrivateLoadAndValidateMPTDll: Looking in EXE directory), ref: 002754A1
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • szInstallDir32, xrefs: 0027525F
                                                                                                                                                                                                                                              • NCPrivateLoadAndValidateMPTDll: Looking in EXE directory, xrefs: 0027549C
                                                                                                                                                                                                                                              • NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x, xrefs: 002756B7
                                                                                                                                                                                                                                              • Software\McAfee\SystemCore, xrefs: 0027521B
                                                                                                                                                                                                                                              • %ls\%ls, xrefs: 00275533
                                                                                                                                                                                                                                              • NCPrivateLoadAndValidateMPTDll: Looking in current directory, xrefs: 002753DE
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseDebugErrorLastOutputString$OpenQueryValue
                                                                                                                                                                                                                                              • String ID: %ls\%ls$NCPrivateLoadAndValidateMPTDll: Looking in EXE directory$NCPrivateLoadAndValidateMPTDll: Looking in current directory$NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x$Software\McAfee\SystemCore$szInstallDir32
                                                                                                                                                                                                                                              • API String ID: 901107078-3767168787
                                                                                                                                                                                                                                              • Opcode ID: c00d0c8c13ae1e1514fc48bba1129021a922a1733783f9e33917af29ea12df9f
                                                                                                                                                                                                                                              • Instruction ID: f5b5968b50c2b8b1988d4b85d4ad2750fa455781190517f0a14ca07a617f5b18
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c00d0c8c13ae1e1514fc48bba1129021a922a1733783f9e33917af29ea12df9f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1D192B1E106299FEF25DF64CC55B9EF7B5AF04300F0481A9E80DA6281DBB19E64CF91
                                                                                                                                                                                                                                              Function 002770D9 Relevance: 27.2, APIs: 4, Strings: 11, Instructions: 977COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00284B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0028521E
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00277D3D
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00277DFC
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 00277DC8
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00277EBB
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Failed to add reserved 1 dimension (, xrefs: 0027769E
                                                                                                                                                                                                                                              • Failed to add event label (, xrefs: 00277508
                                                                                                                                                                                                                                              • Failed to add reserved 5 dimension (, xrefs: 00277CFD
                                                                                                                                                                                                                                              • Failed to add reserved 4 dimension (, xrefs: 00277B63
                                                                                                                                                                                                                                              • Failed to add reserved 3 dimension (, xrefs: 002779CD
                                                                                                                                                                                                                                              • Service has not been initialized, xrefs: 00277E88
                                                                                                                                                                                                                                              • Failed to add event action (, xrefs: 00277379
                                                                                                                                                                                                                                              • z, xrefs: 00277CF1
                                                                                                                                                                                                                                              • Failed to add reserved 2 dimension (, xrefs: 00277834
                                                                                                                                                                                                                                              • u, xrefs: 00277B57
                                                                                                                                                                                                                                              • Failed to add event category (, xrefs: 002771F0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
                                                                                                                                                                                                                                              • String ID: Failed to add event action ($Failed to add event category ($Failed to add event label ($Failed to add reserved 1 dimension ($Failed to add reserved 2 dimension ($Failed to add reserved 3 dimension ($Failed to add reserved 4 dimension ($Failed to add reserved 5 dimension ($Service has not been initialized$u$z
                                                                                                                                                                                                                                              • API String ID: 342047005-3525645681
                                                                                                                                                                                                                                              • Opcode ID: f7983cae214a90c03672d625db883b776f0c9c24a3e5a7f5dea12a3688ba0505
                                                                                                                                                                                                                                              • Instruction ID: b304034e9dc7311ac6b718eb75270ca6b20e04c4648586d67e31aaeac4e32f04
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f7983cae214a90c03672d625db883b776f0c9c24a3e5a7f5dea12a3688ba0505
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4E82F670524245CFDF18EF24C895BAE7BA4EF45304F50819DE81A8B382DB75DA64CFA2
                                                                                                                                                                                                                                              Function 00278FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 245COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CoCreateGuid.OLE32(?), ref: 00278FC8
                                                                                                                                                                                                                                              • StringFromCLSID.OLE32(?,?), ref: 00278FE0
                                                                                                                                                                                                                                              • CoTaskMemFree.OLE32(?), ref: 00279138
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00279173
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002793D1
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • SOFTWARE\McAfee\WebAdvisor, xrefs: 002791FB
                                                                                                                                                                                                                                              • Could not create registry key , xrefs: 0027923F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_taskCreateFreeFromGuidIos_base_dtorStringTaskstd::ios_base::_
                                                                                                                                                                                                                                              • String ID: Could not create registry key $SOFTWARE\McAfee\WebAdvisor
                                                                                                                                                                                                                                              • API String ID: 3741506170-3627174789
                                                                                                                                                                                                                                              • Opcode ID: 1343123debf1f5f50d7f4917a76271f4461ae5d32424df2e8eaabee833af4d74
                                                                                                                                                                                                                                              • Instruction ID: 211255153806abee8bd4dfa2d0c7ef9ed162b56d94bb718fb5a76a8329ddbc6e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1343123debf1f5f50d7f4917a76271f4461ae5d32424df2e8eaabee833af4d74
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D08107716203059FD714EF24DC85BAEB7A8EF45310F50862EF91E97281EB31A9A4CB91
                                                                                                                                                                                                                                              Function 002C14F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 215encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 002C1581
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 002C15B2
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 002C15DD
                                                                                                                                                                                                                                              • CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 002C1625
                                                                                                                                                                                                                                              • CertFreeCRLContext.CRYPT32(?), ref: 002C175E
                                                                                                                                                                                                                                                • Part of subcall function 002DE960: _free.LIBCMT ref: 002DE973
                                                                                                                                                                                                                                              • CertFreeCRLContext.CRYPT32(?), ref: 002C1738
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CertCryptParam$ContextFree$CertificateFromStoreSubject_free
                                                                                                                                                                                                                                              • String ID: %,
                                                                                                                                                                                                                                              • API String ID: 4059466977-489104374
                                                                                                                                                                                                                                              • Opcode ID: 7a9f86a9938300e9de9bbea63071590c632ace7b1820483d676ab2df94fe8f29
                                                                                                                                                                                                                                              • Instruction ID: 38024b388d00f436705a95629d8b0e1733af4a1ef448932e9018cc52ddc0813c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a9f86a9938300e9de9bbea63071590c632ace7b1820483d676ab2df94fe8f29
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54816A75810249DFDF21DF64D841FEEBBB8BF0A344F14421AEC15A7252D731AA28CBA1
                                                                                                                                                                                                                                              Function 00264C8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73processCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 00264CA6
                                                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00264CB8
                                                                                                                                                                                                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 00264CD3
                                                                                                                                                                                                                                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 00264CE9
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00264CFA
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process32$CloseCreateCurrentFirstHandleNextProcessSnapshotToolhelp32
                                                                                                                                                                                                                                              • String ID: saBSI.exe
                                                                                                                                                                                                                                              • API String ID: 592884611-3955546181
                                                                                                                                                                                                                                              • Opcode ID: dda1780fe257d04b4c675ca49633b91907b4605e4c8faf5b372549cde0d8e59c
                                                                                                                                                                                                                                              • Instruction ID: 7bc15372a5e7575cc5bc3d1405e9621e9f071d8b05bee0a67c3d5b102c6d4a19
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dda1780fe257d04b4c675ca49633b91907b4605e4c8faf5b372549cde0d8e59c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E0216A31911300AFC324FF24EC89AAF77D8EF8A320F150229FC55C72D0E73099958AA2
                                                                                                                                                                                                                                              Function 00274F50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000,1CE34B5F), ref: 00274FB5
                                                                                                                                                                                                                                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00274FDF
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00274FF2
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0027500B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentDirectoryErrorLast
                                                                                                                                                                                                                                              • String ID: %ls\%ls
                                                                                                                                                                                                                                              • API String ID: 152501406-2125769799
                                                                                                                                                                                                                                              • Opcode ID: 12b310765a76c190a5c5cab32f455cb52411aa6e253b797896a384a9535cefd5
                                                                                                                                                                                                                                              • Instruction ID: 962dd73e7fddf6f4ee5887b4ad530f0d9973cfd00635426725f94990922de4fd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 12b310765a76c190a5c5cab32f455cb52411aa6e253b797896a384a9535cefd5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C441B671E106159BDB15DF75CC45BAFF6B9AF48700F24813AE809E7281EB75C9108F91
                                                                                                                                                                                                                                              Function 002EE8FE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,002EE8FD,00000002,00000002,?,00000002), ref: 002EE920
                                                                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,002EE8FD,00000002,00000002,?,00000002), ref: 002EE927
                                                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 002EE939
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                              • Opcode ID: 9e2bffc751f99633cbe4dba1b3778c0d3c9a7eb0d9a980e766c9d14320a620ed
                                                                                                                                                                                                                                              • Instruction ID: 8eb27a575155571e6f8f5eb019d9479cf9b4c4097c32d8f4144fe886cd3e4974
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e2bffc751f99633cbe4dba1b3778c0d3c9a7eb0d9a980e766c9d14320a620ed
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 13E0B631060148AFCF526F66ED49A983BADEB48351F458815F90986132CB76ED62CA51
                                                                                                                                                                                                                                              Function 00265C1E Relevance: 3.1, APIs: 2, Instructions: 76comCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CoCreateInstance.OLE32(0032D808,00000000,00000017,0033B024,00000000,1CE34B5F,?,?,?,00000000,00000000,00000000,00308687,000000FF), ref: 00265C7A
                                                                                                                                                                                                                                              • OleRun.OLE32(00000000), ref: 00265C89
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CreateInstance
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 542301482-0
                                                                                                                                                                                                                                              • Opcode ID: 17d856ddeeccff764451c1d13bc42757c9a444911cc99161f5561bbd30d2e64b
                                                                                                                                                                                                                                              • Instruction ID: 2215e596cf008016f7cda38191b022cda8d9b7c80af923a293ab3ddab817f401
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 17d856ddeeccff764451c1d13bc42757c9a444911cc99161f5561bbd30d2e64b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 39219075610615AFD705CB58CC45FAEB7B9EF8CB20F144129F915E73A0DB35AD008A50
                                                                                                                                                                                                                                              Function 00264E1F Relevance: 65.5, APIs: 9, Strings: 28, Instructions: 767COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1406 264e1f-264e73 call 28d6d0 1409 264ec6-264ede call 264d63 1406->1409 1410 264e75-264ec1 call 269bb0 call 269940 call 261b84 call 261be0 call 26136c 1406->1410 1415 264ee0-264f34 call 269bb0 call 269940 call 261b84 call 261be0 call 26136c 1409->1415 1416 264f39-264f46 CoInitializeEx 1409->1416 1410->1409 1449 2658da-2658e1 1415->1449 1418 264f4d-264f51 call 265a4f 1416->1418 1419 264f48-264f4b 1416->1419 1422 264f56-264f7c call 2d8760 1418->1422 1419->1418 1419->1422 1433 264f86 1422->1433 1434 264f7e-264f84 1422->1434 1437 264f88-264f99 call 265d57 1433->1437 1434->1437 1443 264ff1-265008 call 2d8760 1437->1443 1444 264f9b-264fec call 269bb0 call 269940 call 261b84 call 261be0 call 26136c 1437->1444 1454 265012 1443->1454 1455 26500a-265010 1443->1455 1478 2658ba-2658bf 1444->1478 1452 2658e3-2658e9 CloseHandle 1449->1452 1453 2658ef-265913 call 2d8367 1449->1453 1452->1453 1459 265014-26502c call 265db6 1454->1459 1455->1459 1466 26502e-265076 call 269bb0 call 269940 call 261b84 call 261be0 call 26136c 1459->1466 1467 26507b-2650cc call 2da920 call 2d8760 1459->1467 1507 2658ab-2658b3 1466->1507 1483 2650ce-2650d6 call 276bd0 1467->1483 1484 2650d8 1467->1484 1481 2658c6-2658d2 call 2659c2 1478->1481 1482 2658c1 call 267d21 1478->1482 1481->1449 1494 2658d4 CoUninitialize 1481->1494 1482->1481 1486 2650da-2650f0 call 265e16 1483->1486 1484->1486 1497 2650f2-26513e call 269bb0 call 269940 call 261b84 call 261be0 call 26136c 1486->1497 1498 265143-265154 1486->1498 1494->1449 1530 265897-26589c 1497->1530 1500 265156 1498->1500 1501 26515a-265176 1498->1501 1500->1501 1504 26517c-265194 1501->1504 1505 265178 1501->1505 1508 265196 1504->1508 1509 26519a-2651a9 call 293670 1504->1509 1505->1504 1507->1478 1510 2658b5 call 267d21 1507->1510 1508->1509 1517 2651f7-265233 CommandLineToArgvW 1509->1517 1518 2651ab-2651f2 call 269bb0 call 269940 call 261b84 call 261be0 1509->1518 1510->1478 1531 265284-2652b0 call 2da920 GetModuleFileNameW 1517->1531 1532 265235-265282 call 269bb0 call 269940 call 261b84 call 261be0 GetLastError 1517->1532 1548 265310-265318 call 26136c 1518->1548 1536 2658a3-2658a6 call 265946 1530->1536 1537 26589e call 267d21 1530->1537 1545 2652b2-2652fc call 269bb0 call 269940 call 261b84 call 261be0 GetLastError 1531->1545 1546 26531d-265367 call 26d730 call 2da920 GetLongPathNameW 1531->1546 1567 2652ff-26530a call 266140 1532->1567 1536->1507 1537->1536 1545->1567 1564 26536d-265416 call 269bb0 call 269940 call 261b84 call 261be0 GetLastError call 266140 call 2661b0 call 264190 call 26136c call 2dea46 1546->1564 1565 265419-265520 call 26171d * 2 call 295b70 call 263899 * 2 call 2649d2 call 26171d * 2 call 295b70 call 263899 * 2 call 2649d2 1546->1565 1548->1530 1564->1565 1615 265596-2655a8 call 2649d2 1565->1615 1616 265522-265591 call 264a04 call 26171d call 295b70 call 263899 * 2 1565->1616 1567->1548 1621 265611-26564f call 264a4a 1615->1621 1622 2655aa-26560c call 26171d * 2 call 295b70 call 263899 * 2 1615->1622 1616->1615 1640 265651-265693 call 269bb0 call 269940 call 261b84 call 266220 call 26136c 1621->1640 1641 265698-2656a9 call 264b92 1621->1641 1622->1621 1640->1641 1650 26571b-265729 call 263a88 1641->1650 1651 2656ab-265716 call 269bb0 call 269940 call 261b84 call 261be0 1641->1651 1656 26572e-265733 1650->1656 1691 265887-26588c call 26136c 1651->1691 1658 2657ed-265802 call 267d7c 1656->1658 1659 265739-26573b 1656->1659 1672 265806-265881 call 26372a call 269bb0 call 269940 call 261b84 call 261be0 call 266290 1658->1672 1673 265804 1658->1673 1660 265746-26575b call 267d7c 1659->1660 1661 26573d-265740 1659->1661 1674 26575f-2657e8 call 26372a call 269bb0 call 269940 call 261b84 call 261be0 call 266290 call 26136c 1660->1674 1675 26575d 1660->1675 1661->1658 1661->1660 1672->1691 1673->1672 1698 26588f-265892 call 263899 1674->1698 1675->1674 1691->1698 1698->1530
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 0028D6D0: GetModuleHandleW.KERNEL32(kernel32.dll,00264E6C,1CE34B5F), ref: 0028D6D5
                                                                                                                                                                                                                                                • Part of subcall function 0028D6D0: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0028D6E5
                                                                                                                                                                                                                                              • CoInitializeEx.COMBASE(00000000,00000000,1CE34B5F), ref: 00264F3E
                                                                                                                                                                                                                                              • CommandLineToArgvW.SHELL32(?,?), ref: 00265226
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001), ref: 00265276
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 002652A8
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001), ref: 002652F3
                                                                                                                                                                                                                                              • GetLongPathNameW.KERNEL32(?,?,00000104), ref: 0026535F
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000002), ref: 002653AE
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,00000001), ref: 002658E9
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                                • Part of subcall function 0026136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002613A5
                                                                                                                                                                                                                                              • CoUninitialize.OLE32(?,00000001), ref: 002658D4
                                                                                                                                                                                                                                                • Part of subcall function 00276BD0: __Mtx_init_in_situ.LIBCPMT ref: 00276CC0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$HandleInitInitializeIos_base_dtorModuleNameOncestd::ios_base::_$AddressArgvBeginCloseCommandCompleteFileLineLongMtx_init_in_situPathProcUninitialize
                                                                                                                                                                                                                                              • String ID: /no_self_update$/store_xml_on_disk$/xml$BSI installation success. Exit code: $BootStrapInstaller$CommandLineToArgvW failed: $Ended$FALSE$Failed$Failed to allocate memory for event sender service$Failed to create xml updater logger$Failed to create xml updater signature verifier$GetLongPathName failed ($GetModuleFileName failed: $InitSecureDllLoading failed.$Install$InvalidArguments$MAIN_XML$Process$SA/WA installation failed with exit code: $SELF_UPDATE_ALLOWED$STORE_XML_ON_DISK$SaBsi.cpp$Some command line BSI variables are invalid.$Started$TRUE$WaitForOtherBSIToExit failed$failed to initialize updater
                                                                                                                                                                                                                                              • API String ID: 126520999-360321973
                                                                                                                                                                                                                                              • Opcode ID: 117efed2cd9642f2a24e8fbda238e38063f9ddefcea5f2a54cafec823486d8ed
                                                                                                                                                                                                                                              • Instruction ID: 7b2c1cfcc2933f8a8c31222251988aeee225c4d034185f29f41f6708c979767e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 117efed2cd9642f2a24e8fbda238e38063f9ddefcea5f2a54cafec823486d8ed
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF626070920249DFDF15EFA4D895BEDB7B8AF14304F508059F849A7281DB70AE94CFA1
                                                                                                                                                                                                                                              Function 0029EFC0 Relevance: 65.5, APIs: 13, Strings: 24, Instructions: 743COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1717 29efc0-29f053 call 2b41f0 call 2b4430 1722 29f07f-29f13b call 29ea50 call 2da920 * 2 1717->1722 1723 29f055-29f06b call 298650 1717->1723 1738 29f168-29f170 1722->1738 1739 29f13d-29f163 GetLastError call 29e9b0 1722->1739 1726 29f070-29f07a 1723->1726 1728 29fa58-29fa83 call 2b4210 call 2d8367 1726->1728 1741 29f18d-29f1ab call 2b4280 1738->1741 1742 29f172-29f186 1738->1742 1745 29f3cb-29f3e6 call 298650 1739->1745 1748 29f1d8-29f209 call 2b4480 1741->1748 1749 29f1ad-29f1d3 GetLastError call 29e9b0 1741->1749 1742->1741 1745->1728 1755 29f20b-29f231 GetLastError call 29e9b0 1748->1755 1756 29f236-29f255 call 2b4250 1748->1756 1749->1745 1755->1745 1761 29f289-29f29a call 2b4640 1756->1761 1762 29f257-29f286 call 298650 1756->1762 1766 29f29c-29f2ee GetLastError call 29e9b0 call 298650 1761->1766 1767 29f2f3-29f300 call 2b4620 1761->1767 1762->1761 1766->1728 1775 29f329-29f33f call 2b4560 1767->1775 1776 29f302-29f324 GetLastError call 29e9b0 1767->1776 1782 29f389-29f3a7 call 2b44c0 1775->1782 1783 29f341-29f384 GetLastError call 29e9b0 call 298650 1775->1783 1776->1745 1789 29f3a9-29f3c6 GetLastError call 29e9b0 1782->1789 1790 29f3eb-29f41a call 2e594f 1782->1790 1783->1728 1789->1745 1796 29f45a-29f461 1790->1796 1797 29f41c-29f455 call 29e9b0 call 298650 1790->1797 1799 29f463-29f48f 1796->1799 1800 29f4c2-29f4db call 2a08c0 1796->1800 1810 29fa4f-29fa50 call 2de960 1797->1810 1802 29f495-29f49e 1799->1802 1809 29f4e0-29f501 call 2644b2 1800->1809 1802->1802 1805 29f4a0-29f4c0 call 26347e 1802->1805 1805->1809 1815 29f51d-29f523 1809->1815 1816 29f503-29f517 call 2638d0 1809->1816 1817 29fa55 1810->1817 1819 29f530-29f537 1815->1819 1820 29f525-29f52b call 2638d0 1815->1820 1816->1815 1817->1728 1823 29f539-29f53f 1819->1823 1824 29f5a0-29f5de call 2a0230 1819->1824 1820->1819 1826 29f561-29f582 call 298650 1823->1826 1827 29f541-29f55f call 298650 1823->1827 1831 29f5e0-29f5e6 1824->1831 1832 29f657-29f669 call 2638d0 1824->1832 1837 29f585-29f59b call 29e9b0 1826->1837 1827->1837 1835 29f5e8-29f5f7 1831->1835 1836 29f625-29f654 1831->1836 1847 29f66b 1832->1847 1848 29f66d-29f676 PathFileExistsW 1832->1848 1839 29f5f9-29f607 1835->1839 1840 29f60f-29f61f call 2d8375 1835->1840 1836->1832 1849 29fa44-29fa4a call 2638d0 1837->1849 1844 29f60d 1839->1844 1845 29fadf-29fb00 call 2dd60f 1839->1845 1840->1836 1844->1840 1860 29fb0d-29fb11 1845->1860 1861 29fb02-29fb0a call 2d8375 1845->1861 1847->1848 1850 29f83d-29f844 1848->1850 1851 29f67c-29f68b 1848->1851 1849->1810 1855 29f848-29f86a CreateFileW 1850->1855 1856 29f846 1850->1856 1857 29f8b8-29f8bc 1851->1857 1858 29f691-29f6a4 1851->1858 1862 29f8fa-29f942 call 2b35a0 call 2b45f0 1855->1862 1863 29f870-29f8b3 call 29e9b0 call 298650 1855->1863 1856->1855 1866 29f8be 1857->1866 1867 29f8c0-29f8f5 call 298650 call 29e9b0 1857->1867 1864 29fada call 2634d0 1858->1864 1865 29f6aa-29f6ae 1858->1865 1861->1860 1891 29f948 1862->1891 1892 29f9d6-29fa1a CloseHandle call 2b35f0 call 26149c 1862->1892 1863->1849 1864->1845 1870 29f6b8-29f6f2 1865->1870 1871 29f6b0-29f6b2 1865->1871 1866->1867 1867->1849 1877 29f739-29f7ba call 2da3a0 DeleteFileW 1870->1877 1878 29f6f4-29f6ff 1870->1878 1871->1870 1895 29f7bc 1877->1895 1896 29f7be-29f7ca call 2e65f0 1877->1896 1882 29f708-29f70f 1878->1882 1883 29f701-29f706 1878->1883 1889 29f712-29f733 call 2633c3 1882->1889 1883->1889 1889->1877 1899 29f950-29f958 1891->1899 1914 29fa1c-29fa1f 1892->1914 1915 29fa24-29fa33 call 29e9b0 1892->1915 1895->1896 1906 29f7cc-29f7ee call 2dd73d call 29e9b0 1896->1906 1907 29f82e-29f838 call 2638d0 1896->1907 1899->1892 1904 29f95a-29f973 WriteFile 1899->1904 1908 29f979-29f9c9 call 29e990 call 2b4140 call 2b45f0 1904->1908 1909 29fa86-29fad5 call 29e9b0 call 298650 CloseHandle 1904->1909 1927 29f7f0 1906->1927 1928 29f7f2-29f829 call 298650 call 2638d0 1906->1928 1907->1850 1934 29f9ce-29f9d0 1908->1934 1929 29fa3a 1909->1929 1914->1915 1915->1929 1927->1928 1928->1849 1929->1849 1934->1892 1934->1899
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0029F13D
                                                                                                                                                                                                                                                • Part of subcall function 00298650: std::locale::_Init.LIBCPMT ref: 0029882F
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,?,?,00000006,00000000,?,?,?,00000000,?,?,?,00000000,00000000), ref: 0029FAC8
                                                                                                                                                                                                                                                • Part of subcall function 002DE960: _free.LIBCMT ref: 002DE973
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleInitLast_freestd::locale::_
                                                                                                                                                                                                                                              • String ID: <$<Z2$Cache-Control: no-cache$CreateFile failed (%d)$File already exists: %s$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, ignore proxy flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk::<lambda_2af623cb1b195cc2505e5df23daadde2>::operator ()$Unable to allocate %d bytes$Unable to extract the filename from url (%s)$Unable to open HTTP transaction$Unable to rename the old file (%d): %s$WinHttpCrackUrl failed (%d), url: %s$WriteFile failed (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$empty filename$false$true
                                                                                                                                                                                                                                              • API String ID: 2292809486-2117519897
                                                                                                                                                                                                                                              • Opcode ID: 606a9b19d0e82d7c005b7bf334130c8d2a2c74fb66f00fb1e257ba667c1f70d2
                                                                                                                                                                                                                                              • Instruction ID: 0e3d0114a8ce2a485334a4bc947e2a5603eab477ba2c9170915a4ec000003387
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 606a9b19d0e82d7c005b7bf334130c8d2a2c74fb66f00fb1e257ba667c1f70d2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 39629DB0A50629EBDF65DF10CD45FE9B7B4AF45304F0441E8F618A7291DBB0AAA0CF94
                                                                                                                                                                                                                                              Function 002A65F0 Relevance: 38.9, APIs: 4, Strings: 18, Instructions: 416COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 2370 2a65f0-2a6642 2371 2a6646-2a664a 2370->2371 2372 2a6644 2370->2372 2373 2a6650-2a6662 call 261b0c 2371->2373 2374 2a68c4-2a68de 2371->2374 2372->2371 2373->2374 2382 2a6668-2a6690 2373->2382 2376 2a6a8f-2a6aa3 call 2d88fa 2374->2376 2377 2a68e4-2a6900 call 291ac0 2374->2377 2376->2377 2384 2a6aa9-2a6cc3 call 2a60c0 * 3 call 26347e call 2a60c0 * 2 call 26347e * 4 call 2a6400 call 2d85d4 call 2d85bf call 2d88b0 2376->2384 2387 2a695a-2a6960 2377->2387 2388 2a6902-2a6912 2377->2388 2385 2a6712 2382->2385 2386 2a6696-2a66be 2382->2386 2384->2377 2390 2a6719-2a6727 2385->2390 2393 2a66c4-2a66cd 2386->2393 2391 2a6962 2387->2391 2392 2a6964-2a69a1 call 298650 2387->2392 2394 2a6916-2a6923 2388->2394 2395 2a6914 2388->2395 2400 2a6729-2a672f call 2638d0 2390->2400 2401 2a6734-2a673b 2390->2401 2391->2392 2415 2a69a4-2a69ad 2392->2415 2393->2393 2396 2a66cf-2a6710 call 26347e call 2993a0 2393->2396 2397 2a692d-2a694e call 261b0c 2394->2397 2398 2a6925-2a6927 2394->2398 2395->2394 2396->2385 2396->2390 2417 2a69db-2a69e4 2397->2417 2418 2a6954 2397->2418 2398->2397 2400->2401 2407 2a67a8-2a67df call 2da920 2401->2407 2408 2a673d-2a677c call 298650 2401->2408 2425 2a681d 2407->2425 2426 2a67e1-2a67f5 2407->2426 2428 2a6780-2a6789 2408->2428 2415->2415 2422 2a69af-2a69b7 call 26347e 2415->2422 2417->2387 2423 2a69ea-2a69f6 2417->2423 2418->2387 2418->2423 2435 2a69bc-2a69d8 call 2d8367 2422->2435 2423->2387 2430 2a69fc-2a6a1c SHGetKnownFolderPath 2423->2430 2432 2a681f-2a6843 GetEnvironmentVariableW 2425->2432 2426->2425 2431 2a67f7-2a67fd 2426->2431 2428->2428 2434 2a678b-2a67a3 call 26347e call 2638d0 2428->2434 2436 2a6a1e-2a6a22 2430->2436 2437 2a6a54-2a6a8a call 2614a1 CoTaskMemFree call 2644b2 call 2638d0 2430->2437 2438 2a6800 2431->2438 2439 2a686e-2a68b1 GetLastError call 298650 2432->2439 2440 2a6845-2a684a 2432->2440 2434->2435 2446 2a6a26-2a6a4f call 298650 call 2614a1 2436->2446 2447 2a6a24 2436->2447 2437->2435 2438->2425 2449 2a6802-2a6805 2438->2449 2464 2a68b4-2a68bd 2439->2464 2440->2439 2451 2a684c-2a6865 call 2614a1 call 2638d0 2440->2451 2446->2435 2447->2446 2456 2a686a-2a686c 2449->2456 2457 2a6807-2a681b 2449->2457 2451->2435 2456->2432 2457->2425 2457->2438 2464->2464 2469 2a68bf 2464->2469 2469->2374
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetEnvironmentVariableW.KERNEL32(ProgramW6432,?,00000104), ref: 002A683B
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002A686E
                                                                                                                                                                                                                                              • SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?,?,?,?), ref: 002A6A15
                                                                                                                                                                                                                                              • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000000,?,?,?,?), ref: 002A6A6B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: EnvironmentErrorFolderFreeKnownLastPathTaskVariable
                                                                                                                                                                                                                                              • String ID: CSIDL_COMMON_APPDATA$CSIDL_COMMON_DOCUMENTS$CSIDL_COMMON_STARTUP$CSIDL_PROGRAM_FILES$CSIDL_PROGRAM_FILESX64$CSIDL_PROGRAM_FILESX86$CSIDL_PROGRAM_FILES_COMMON$CSIDL_SYSTEM$CSIDL_SYSTEMX86$CSIDL_WINDOWS$Error retrieving directory %s$GetEnvironmentVariable failed (%d)$NWebAdvisor::NXmlUpdater::CDirSubstitution::Substitute$ProgramFiles$ProgramW6432$Unable to get the platform$Unknown folder identifier: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DirSubstitution.cpp
                                                                                                                                                                                                                                              • API String ID: 3946049928-1874136459
                                                                                                                                                                                                                                              • Opcode ID: 1669c0bfd901ba5b6474ea04894c3f1198fa692b60b8b1f523f755739abaa7a2
                                                                                                                                                                                                                                              • Instruction ID: f75202942efab564b1ce40d74c625842f31659b4d105033361070925b2063542
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1669c0bfd901ba5b6474ea04894c3f1198fa692b60b8b1f523f755739abaa7a2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9902CD74A103689BDB21DF64CC4ABEAB7B4FF15704F144188E80967291EFB56AD8CF50
                                                                                                                                                                                                                                              Function 0029EAA0 Relevance: 37.8, APIs: 8, Strings: 17, Instructions: 326COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 2492 29eaa0-29eb46 call 2b41f0 call 2b4430 2497 29ec1b-29ec28 2492->2497 2498 29eb4c-29ebf6 call 2da920 * 2 2492->2498 2499 29ef5b-29ef83 call 2b4210 call 2d8367 2497->2499 2509 29ebf8-29ec18 GetLastError call 298650 2498->2509 2510 29ec2d-29ec35 2498->2510 2509->2497 2512 29ec52-29ec6d call 2b4280 2510->2512 2513 29ec37-29ec4b 2510->2513 2517 29ec6f-29ec9f GetLastError call 298650 2512->2517 2518 29eca4-29ecd5 call 2b4480 2512->2518 2513->2512 2517->2499 2523 29ed0c-29ed2b call 2b4250 2518->2523 2524 29ecd7-29ed07 GetLastError call 298650 2518->2524 2529 29ed2d-29ed49 GetLastError call 298650 2523->2529 2530 29ed4c-29ed5d call 2b4640 2523->2530 2524->2499 2529->2530 2535 29ed5f-29eda0 GetLastError call 298650 2530->2535 2536 29eda5-29edb2 call 2b4620 2530->2536 2535->2499 2541 29ede5-29edfb call 2b4560 2536->2541 2542 29edb4-29ede0 GetLastError call 298650 2536->2542 2547 29edfd-29ee2f GetLastError call 298650 2541->2547 2548 29ee34-29ee52 call 2b44c0 2541->2548 2542->2499 2547->2499 2553 29ee88-29eea4 call 2e594f 2548->2553 2554 29ee54-29ee83 GetLastError call 298650 2548->2554 2559 29eeda-29ef01 call 2b45f0 2553->2559 2560 29eea6-29eed5 call 298650 call 2de960 2553->2560 2554->2499 2564 29ef06-29ef08 2559->2564 2560->2499 2566 29ef0a 2564->2566 2567 29ef46-29ef58 call 2de960 2564->2567 2570 29ef10-29ef18 2566->2570 2567->2499 2570->2567 2572 29ef1a-29ef22 2570->2572 2573 29ef24-29ef44 call 2b45f0 2572->2573 2574 29ef86-29efb9 call 298650 call 2de960 2572->2574 2573->2567 2573->2570 2574->2499
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(1CE34B5F), ref: 0029EBF9
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(1CE34B5F,?,00000000,?), ref: 0029EC70
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(1CE34B5F,GET,?,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0029ECD8
                                                                                                                                                                                                                                                • Part of subcall function 00298650: std::locale::_Init.LIBCPMT ref: 0029882F
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(1CE34B5F,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0029ED2E
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(1CE34B5F,true,00000000,00000000,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0029ED75
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$Initstd::locale::_
                                                                                                                                                                                                                                              • String ID: @])$Cache-Control: no-cache$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, proxy ignore flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::From::<lambda_1effc98e56da47b46c9f3c737083b6c0>::operator ()$Not enough space in buffer: bufferLength(%d) Read(%d)$Unable to allocate %d bytes$WinHttpCrackUrl failed (%d), url: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$false$true
                                                                                                                                                                                                                                              • API String ID: 1579124236-2915422526
                                                                                                                                                                                                                                              • Opcode ID: 9dc0560c1a381749b49875c59adb43d12ccc7fd3a8334a7ae1f69a002660da96
                                                                                                                                                                                                                                              • Instruction ID: d06501a150141257a09405278bf46c6c1e5f330965f5431305f52465cf0f4c83
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9dc0560c1a381749b49875c59adb43d12ccc7fd3a8334a7ae1f69a002660da96
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D5C1B4B0A50729AAEF21DF10DC82FE9B778AF15704F404199F608771C2EBB15A94CF69
                                                                                                                                                                                                                                              Function 00299400 Relevance: 37.6, APIs: 7, Strings: 14, Instructions: 871libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 2581 299400-299483 GetModuleHandleW 2582 2994c2 2581->2582 2583 299485-299495 GetProcAddress 2581->2583 2584 2994c4-2994dc 2582->2584 2583->2582 2585 299497-2994b3 GetCurrentProcess 2583->2585 2586 2994e0-2994e9 2584->2586 2585->2582 2590 2994b5-2994bc 2585->2590 2586->2586 2587 2994eb-29952f call 26347e 2586->2587 2593 299530-299539 2587->2593 2590->2582 2592 2994be-2994c0 2590->2592 2592->2584 2593->2593 2594 29953b-299567 call 26347e call 298c60 2593->2594 2599 299569-299580 call 26347e 2594->2599 2600 299585-299592 2594->2600 2599->2600 2602 2995c9-2995f6 2600->2602 2603 299594-2995a9 2600->2603 2606 2995f8-29960d 2602->2606 2607 29962d-299674 call 2991a0 2602->2607 2604 2995ab-2995b9 2603->2604 2605 2995bf-2995c6 call 2d8375 2603->2605 2604->2605 2608 29a108-29a121 call 2dd60f 2604->2608 2605->2602 2610 29960f-29961d 2606->2610 2611 299623-29962a call 2d8375 2606->2611 2619 299677-299680 2607->2619 2610->2608 2610->2611 2611->2607 2619->2619 2620 299682-2996a8 call 26347e call 298c60 2619->2620 2625 2996aa-2996b1 2620->2625 2626 2996be-2996cb 2620->2626 2627 2996b3 2625->2627 2628 2996b5-2996b9 call 26347e 2625->2628 2629 2996cd-2996e2 2626->2629 2630 299702-29972f 2626->2630 2627->2628 2628->2626 2632 2996f8-2996ff call 2d8375 2629->2632 2633 2996e4-2996f2 2629->2633 2634 299731-299746 2630->2634 2635 299766-2997c9 call 2da920 GetModuleFileNameW 2630->2635 2632->2630 2633->2632 2638 299748-299756 2634->2638 2639 29975c-299763 call 2d8375 2634->2639 2644 2997cb-2997fb GetLastError call 298650 2635->2644 2645 299816-299884 call 2a0750 call 263f22 call 2638d0 call 2da920 GetLongPathNameW 2635->2645 2638->2639 2639->2635 2650 299800-299809 2644->2650 2663 2998eb-2998f1 2645->2663 2664 299886-2998e8 GetLastError call 298650 call 2dea46 2645->2664 2650->2650 2652 29980b-299811 2650->2652 2655 29990b-299948 call 26347e 2652->2655 2661 299950-299959 2655->2661 2661->2661 2662 29995b-299987 call 26347e call 298c60 2661->2662 2675 299989-2999a0 call 26347e 2662->2675 2676 2999a5-2999b2 2662->2676 2667 2998f4-2998fd 2663->2667 2664->2663 2667->2667 2670 2998ff-29990a 2667->2670 2670->2655 2675->2676 2678 2999e9-299a16 2676->2678 2679 2999b4-2999c9 2676->2679 2682 299a18-299a2d 2678->2682 2683 299a4d-299abf call 26347e 2678->2683 2680 2999cb-2999d9 2679->2680 2681 2999df-2999e6 call 2d8375 2679->2681 2680->2681 2681->2678 2686 299a2f-299a3d 2682->2686 2687 299a43-299a4a call 2d8375 2682->2687 2692 299ac0-299ac9 2683->2692 2686->2687 2687->2683 2692->2692 2693 299acb-299af7 call 26347e call 298c60 2692->2693 2698 299af9-299b10 call 26347e 2693->2698 2699 299b15-299b22 2693->2699 2698->2699 2701 299b59-299b86 2699->2701 2702 299b24-299b39 2699->2702 2705 299b88-299b9d 2701->2705 2706 299bbd-299c2f call 26347e 2701->2706 2703 299b3b-299b49 2702->2703 2704 299b4f-299b56 call 2d8375 2702->2704 2703->2704 2704->2701 2708 299b9f-299bad 2705->2708 2709 299bb3-299bba call 2d8375 2705->2709 2715 299c30-299c39 2706->2715 2708->2709 2709->2706 2715->2715 2716 299c3b-299c67 call 26347e call 298c60 2715->2716 2721 299c69-299c80 call 26347e 2716->2721 2722 299c85-299c92 2716->2722 2721->2722 2724 299cc9-299cf6 2722->2724 2725 299c94-299ca9 2722->2725 2728 299cf8-299d0d 2724->2728 2729 299d2d-299d69 call 298f20 call 29a130 2724->2729 2726 299cab-299cb9 2725->2726 2727 299cbf-299cc6 call 2d8375 2725->2727 2726->2727 2727->2724 2732 299d0f-299d1d 2728->2732 2733 299d23-299d2a call 2d8375 2728->2733 2740 299d6b-299d6d 2729->2740 2741 299d72-299dae call 298f60 call 29a130 2729->2741 2732->2733 2733->2729 2740->2741 2746 299db0-299db2 2741->2746 2747 299db7-299df3 call 298ee0 call 29a130 2741->2747 2746->2747 2752 299dfc-299e38 call 299120 call 29a130 2747->2752 2753 299df5-299df7 2747->2753 2758 299e3a-299e3c 2752->2758 2759 299e41-299e7d call 299120 call 29a130 2752->2759 2753->2752 2758->2759 2764 299e7f-299e81 2759->2764 2765 299e86-299ec2 call 2990e0 call 29a130 2759->2765 2764->2765 2770 299ecb-299f07 call 299160 call 29a130 2765->2770 2771 299ec4-299ec6 2765->2771 2776 299f09-299f0b 2770->2776 2777 299f10-299f4c call 299060 call 29a130 2770->2777 2771->2770 2776->2777 2782 299f4e-299f50 2777->2782 2783 299f55-299f91 call 299060 call 29a130 2777->2783 2782->2783 2788 299f9a-299fd6 call 299020 call 29a130 2783->2788 2789 299f93-299f95 2783->2789 2794 299fd8-299fda 2788->2794 2795 299fdf-29a01b call 2990a0 call 29a130 2788->2795 2789->2788 2794->2795 2800 29a01d-29a01f 2795->2800 2801 29a024-29a060 call 298fa0 call 29a130 2795->2801 2800->2801 2806 29a069-29a0a5 call 298fe0 call 29a130 2801->2806 2807 29a062-29a064 2801->2807 2812 29a0ae-29a0e3 call 298ea0 call 29a130 2806->2812 2813 29a0a7-29a0a9 2806->2813 2807->2806 2818 29a0ec-29a107 call 2d8367 2812->2818 2819 29a0e5-29a0e7 2812->2819 2813->2812 2819->2818
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32,1CE34B5F,?), ref: 0029947B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0029948B
                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?), ref: 002994A8
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,0033A52C,0033A52A), ref: 002997C1
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,0033A52C,0033A52A), ref: 002997CB
                                                                                                                                                                                                                                              • GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 0029987C
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0029989A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLastModuleName$AddressCurrentFileHandleLongPathProcProcess
                                                                                                                                                                                                                                              • String ID: $w2$0p2$0w2$1.1$<w2$GetLongPathName failed (%d) for %s$GetModuleFileName failed (%d)$IsWow64Process$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetExtractDir$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32$>2$r2$v2
                                                                                                                                                                                                                                              • API String ID: 891933594-285063151
                                                                                                                                                                                                                                              • Opcode ID: 39eb48a23461f2597a4ef527cd92c70d23c47f1c2411bf4e82b204a1a3bc9ab0
                                                                                                                                                                                                                                              • Instruction ID: 8846fad03969249e5f439397127a62464c41b485bebc9cde37bb2561f7e667c2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39eb48a23461f2597a4ef527cd92c70d23c47f1c2411bf4e82b204a1a3bc9ab0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E672CDB0A102189FDF24CF68CC85B9DB7B9AF49314F1041DCE609AB291DB74AE94CF65
                                                                                                                                                                                                                                              Function 0029BC60 Relevance: 33.8, APIs: 2, Strings: 17, Instructions: 570fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 2822 29bc60-29bd0a call 26347e 2825 29bd0c 2822->2825 2826 29bd0e-29bd14 2822->2826 2825->2826 2827 29bd18-29bd39 call 29fbe0 2826->2827 2828 29bd16 2826->2828 2831 29bd3b-29bd3f 2827->2831 2832 29bd6e-29bd94 PathFindExtensionW call 2e2041 2827->2832 2828->2827 2834 29bd41 2831->2834 2835 29bd43-29bd63 call 298650 2831->2835 2839 29bdaa-29bdbe 2832->2839 2840 29bd96-29bda8 call 2e2041 2832->2840 2834->2835 2841 29bd69 2835->2841 2842 29be5d-29be5f 2835->2842 2844 29bdc9-29bdce call 2aeb20 2839->2844 2845 29bdc0-29bdc5 call 2c21d0 2839->2845 2840->2839 2853 29bdea-29bdfa call 29bbf0 2840->2853 2847 29be4b-29be57 DeleteFileW 2841->2847 2846 29be63-29be69 2842->2846 2855 29bdd1-29bdd3 2844->2855 2854 29bdc7 2845->2854 2851 29be99-29beb3 2846->2851 2852 29be6b-29be7d 2846->2852 2847->2842 2859 29bee3-29bf00 call 2d8367 2851->2859 2860 29beb5-29bec7 2851->2860 2856 29be8f-29be96 call 2d8375 2852->2856 2857 29be7f-29be8d 2852->2857 2872 29bdfc-29be0e 2853->2872 2873 29be61 2853->2873 2854->2855 2855->2853 2861 29bdd5-29bde8 2855->2861 2856->2851 2857->2856 2862 29bf03-29bf63 call 2dd60f 2857->2862 2865 29bed9-29bee0 call 2d8375 2860->2865 2866 29bec9-29bed7 2860->2866 2869 29be37-29be48 call 298650 2861->2869 2880 29bf65-29bf6f 2862->2880 2881 29bf74-29c0e0 call 26347e call 2967e0 call 2638d0 call 26347e call 2967e0 call 2638d0 call 26347e call 2967e0 call 2638d0 call 26347e call 2967e0 call 2638d0 call 26347e call 2967e0 call 2638d0 2862->2881 2865->2859 2866->2862 2866->2865 2869->2847 2876 29be10 2872->2876 2877 29be12-29be1f call 2e2041 2872->2877 2873->2846 2876->2877 2877->2873 2889 29be21-29be32 2877->2889 2884 29c387-29c39d call 298650 2880->2884 2927 29c37d-29c382 2881->2927 2928 29c0e6-29c0ee 2881->2928 2892 29c39f-29c3a4 2884->2892 2889->2869 2894 29c3c7-29c3e4 call 2d8367 2892->2894 2895 29c3a6-29c3b0 2892->2895 2895->2894 2897 29c3b2-29c3be 2895->2897 2897->2894 2904 29c3c0-29c3c2 2897->2904 2904->2894 2927->2884 2928->2927 2929 29c0f4-29c0fc 2928->2929 2930 29c0fe-29c113 call 2614a1 2929->2930 2931 29c115-29c121 call 2614c1 2929->2931 2936 29c126-29c13c call 2644b2 2930->2936 2931->2936 2939 29c14c-29c153 2936->2939 2940 29c13e-29c147 call 2638d0 2936->2940 2942 29c155-29c161 call 2638d0 2939->2942 2943 29c166-29c171 2939->2943 2940->2939 2942->2943 2945 29c188-29c197 call 2614c1 2943->2945 2946 29c173-29c186 call 2614a1 2943->2946 2951 29c19a-29c1b0 call 2644b2 2945->2951 2946->2951 2954 29c1c3-29c1ca 2951->2954 2955 29c1b2-29c1be call 2638d0 2951->2955 2956 29c1dd-29c1e5 2954->2956 2957 29c1cc-29c1d8 call 2638d0 2954->2957 2955->2954 2960 29c1fc-29c20b call 2614c1 2956->2960 2961 29c1e7-29c1fa call 2614a1 2956->2961 2957->2956 2966 29c20e-29c221 call 2644b2 2960->2966 2961->2966 2969 29c231-29c238 2966->2969 2970 29c223-29c22c call 2638d0 2966->2970 2971 29c23a-29c240 call 2638d0 2969->2971 2972 29c245-29c25e call 29a380 2969->2972 2970->2969 2971->2972 2977 29c264-29c271 call 29a380 2972->2977 2978 29c346-29c34b 2972->2978 2977->2978 2984 29c277-29c284 call 29a380 2977->2984 2979 29c34d-29c35e call 298650 2978->2979 2985 29c361 2979->2985 2984->2978 2990 29c28a-29c297 2984->2990 2987 29c363-29c37b call 2638d0 * 3 2985->2987 2987->2892 2992 29c299 2990->2992 2993 29c29b-29c2aa call 304db0 2990->2993 2992->2993 2998 29c2ac-29c2ca call 298650 2993->2998 2999 29c2cf-29c301 call 2614a1 call 2967e0 call 2638d0 2993->2999 2998->2985 3010 29c323-29c33d call 29bc60 2999->3010 3011 29c303-29c310 call 29a380 2999->3011 3014 29c342-29c344 3010->3014 3016 29c31b-29c31f 3011->3016 3017 29c312-29c319 3011->3017 3014->2987 3016->3010 3018 29c321 3016->3018 3017->2979 3018->3010
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • PathFindExtensionW.SHLWAPI(00000000,?,?,?,?,0033BFD0,00000000,1CE34B5F), ref: 0029BD7A
                                                                                                                                                                                                                                              • DeleteFileW.KERNEL32(00000000), ref: 0029BE57
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteExtensionFileFindPath
                                                                                                                                                                                                                                              • String ID: .cab$.exe$DestDir$DestFile$Location$MD5$NWebAdvisor::NXmlUpdater::CDownloadCommand::DownloadCommand$NWebAdvisor::NXmlUpdater::CDownloadCommand::Execute$Unable to create destination directory (%d)$Unable to download %s$Unable to get substitute download variables$Unable to read Location and/or DestDir attribute of DOWNLOAD command$Unable to verify MD5, deleting file: %s$Unable to verify signature, deleting file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DownloadCommand.cpp$extra$invalid substitutor
                                                                                                                                                                                                                                              • API String ID: 3618814920-733304951
                                                                                                                                                                                                                                              • Opcode ID: 4b01560137b0f3aba826c087605e371bb7a1745dc23a216b1eb040a879a3a321
                                                                                                                                                                                                                                              • Instruction ID: 6aa0cf7da70c00be306d9ef54b9ee5845c4cf1473c5e7247c385f3fe80eedde4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4b01560137b0f3aba826c087605e371bb7a1745dc23a216b1eb040a879a3a321
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 01228E71E10208DBDF11DFA4DC95BEEB7B9AF18304F104159E915A7282DB74AA68CFA0
                                                                                                                                                                                                                                              Function 00270890 Relevance: 30.3, APIs: 13, Strings: 4, Instructions: 560COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 3210 270890-2708e2 call 2c3bab 3213 271045-271046 call 2c3faf 3210->3213 3214 2708e8-2708ee 3210->3214 3218 27104b call 2dd60f 3213->3218 3216 2708f4-27090b ConvertStringSecurityDescriptorToSecurityDescriptorW 3214->3216 3217 270a53-270a70 call 2da920 3214->3217 3219 270911-270939 3216->3219 3220 27101f-271042 call 2c3bbc call 2d8367 3216->3220 3230 270a75-270ab6 call 273110 3217->3230 3231 270a72 3217->3231 3227 271050-271053 3218->3227 3223 27093d-270942 3219->3223 3224 27093b 3219->3224 3228 270945-27094e 3223->3228 3224->3223 3232 271055-27105a 3227->3232 3233 27105c-271069 3227->3233 3228->3228 3234 270950-27099f call 26f520 call 26e640 3228->3234 3243 270abc-270ac0 3230->3243 3244 270fa9-27101c call 272b90 call 2c2bfd 3230->3244 3231->3230 3237 27106c-271098 call 262a82 call 2628d1 call 2da332 3232->3237 3233->3237 3255 2709a4-2709bf 3234->3255 3248 270ac6-270bba call 2d8713 call 2da920 call 2c3367 call 2c3184 call 2c33f6 call 263128 call 2c3084 call 2c31e9 3243->3248 3249 270d19-270d26 3243->3249 3244->3220 3331 270bef-270c12 call 2c5688 3248->3331 3332 270bbc-270bcc call 2c3367 3248->3332 3251 270d2a-270d53 call 2689b0 3249->3251 3252 270d28 3249->3252 3275 270e00-270e0a 3251->3275 3276 270d59-270d70 call 262c9c 3251->3276 3252->3251 3260 2709c1-2709d6 3255->3260 3261 2709fc-270a1b 3255->3261 3262 2709ec-2709f9 call 2d8375 3260->3262 3263 2709d8-2709e6 3260->3263 3265 270a31-270a40 3261->3265 3266 270a1d-270a1f 3261->3266 3262->3261 3263->3218 3263->3262 3272 270a42-270a4f LocalFree 3265->3272 3273 270a51 3265->3273 3266->3220 3274 270a25-270a2c LocalFree 3266->3274 3272->3217 3273->3217 3274->3220 3275->3244 3278 270e10-270e3a call 262c9c 3275->3278 3287 270d72-270d8a 3276->3287 3288 270db8-270dc3 call 2c38a1 3276->3288 3289 270e3c-270e6c call 272380 3278->3289 3290 270e89-270eb2 call 2c38a1 3278->3290 3287->3288 3311 270d8c-270db2 3287->3311 3298 270dc5-270dc8 call 262510 3288->3298 3299 270dcd-270de5 3288->3299 3312 270e6e-270e79 call 2c38a1 3289->3312 3302 270eb4-270eb7 call 262510 3290->3302 3303 270ebc 3290->3303 3298->3299 3306 270de7-270df4 3299->3306 3307 270dfc 3299->3307 3302->3303 3310 270ec0-270ed4 3303->3310 3306->3307 3307->3275 3314 270ed6-270ee3 3310->3314 3315 270eeb-270f0d 3310->3315 3311->3227 3311->3288 3325 270e83-270e87 3312->3325 3326 270e7b-270e7e call 262510 3312->3326 3314->3315 3315->3244 3319 270f13 3315->3319 3323 270f15-270f18 3319->3323 3324 270f1e-270f2b call 273030 3319->3324 3323->3244 3323->3324 3336 270f2d-270f63 3324->3336 3337 270f78-270f82 3324->3337 3325->3310 3326->3325 3347 270c14-270c16 3331->3347 3348 270c5f-270c7e call 272c50 3331->3348 3344 270bde-270bec call 2c33bf 3332->3344 3345 270bce-270bd9 3332->3345 3336->3337 3342 270f65-270f68 3336->3342 3339 270f86-270fa4 call 26e790 call 271740 3337->3339 3340 270f84 3337->3340 3339->3244 3340->3339 3342->3233 3343 270f6e-270f73 3342->3343 3343->3237 3344->3331 3345->3344 3352 270c21-270c2d 3347->3352 3353 270c18-270c1e call 2de960 3347->3353 3360 270c80-270c9a 3348->3360 3361 270caf-270cb4 3348->3361 3358 270c30-270c34 3352->3358 3353->3352 3358->3358 3359 270c36-270c4e call 2e594f 3358->3359 3359->3348 3369 270c50-270c5c call 2da3a0 3359->3369 3360->3361 3376 270c9c-270caa 3360->3376 3364 270cb6-270ccd 3361->3364 3365 270ce2-270ceb 3361->3365 3364->3365 3378 270ccf-270cdd 3364->3378 3365->3249 3368 270ced-270d04 3365->3368 3368->3249 3380 270d06-270d14 3368->3380 3369->3348 3376->3361 3378->3365 3380->3249
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 00270903
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?), ref: 00270A26
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?), ref: 00270A43
                                                                                                                                                                                                                                                • Part of subcall function 00262510: __EH_prolog3_catch.LIBCMT ref: 00262517
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00270B08
                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00270B50
                                                                                                                                                                                                                                              • std::_Locinfo::~_Locinfo.LIBCPMT ref: 00270B86
                                                                                                                                                                                                                                              • std::locale::_Init.LIBCPMT ref: 00270B97
                                                                                                                                                                                                                                              • std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00270BA4
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00270BC0
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00270BE1
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00270BF2
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00271017
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 00271020
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockitstd::locale::_$DescriptorFreeLocalLocimp::_Lockit::_Security$AddfacConvertH_prolog3_catchInitIos_base_dtorLocimpLocimp_LocinfoLocinfo::_Locinfo::~_Locinfo_ctorLockit::~_Mtx_unlockNew_Stringstd::ios_base::_
                                                                                                                                                                                                                                              • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                                                                              • API String ID: 4127577005-3388121372
                                                                                                                                                                                                                                              • Opcode ID: 703053cbce85529c5beb265aed362a9ee301fd42b5131f9cb646981105a51cf4
                                                                                                                                                                                                                                              • Instruction ID: b8b2eefe50d2e90472a775da860560ab548a7fff52087dcf725e11416aa979bc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 703053cbce85529c5beb265aed362a9ee301fd42b5131f9cb646981105a51cf4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9A329D70D10259CFDB15DFA8C885BDDBBB4AF08304F1484A9E909AB391DB70AE94CF91
                                                                                                                                                                                                                                              Function 002859AA Relevance: 28.4, APIs: 7, Strings: 9, Instructions: 407COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 3495 2859aa-285b7a call 286440 call 279180 3508 285b7f-285b81 3495->3508 3509 285b7a call 279180 3495->3509 3510 285b83-285b8d 3508->3510 3511 285bc4-285be0 call 2611f3 3508->3511 3509->3508 3513 285c8d-285ccd call 286440 3510->3513 3514 285b93-285ba5 3510->3514 3521 285cfc-285d06 3511->3521 3522 285be6-285c59 call 269bb0 call 269940 call 261b84 call 261be0 call 26b8a0 call 2c2bfd 3511->3522 3528 285db3-285dc0 3513->3528 3529 285cd3-285cd8 3513->3529 3515 285bab-285bbf 3514->3515 3516 285c83-285c8a call 2d8375 3514->3516 3515->3516 3516->3513 3524 285d08-285d1a 3521->3524 3525 285d3a-285d67 call 286440 3521->3525 3522->3513 3602 285c5b-285c6d 3522->3602 3530 285d1c-285d2a 3524->3530 3531 285d30-285d37 call 2d8375 3524->3531 3546 285d78-285d82 3525->3546 3547 285d69-285d73 call 27aad0 3525->3547 3536 285dc9-285dce 3528->3536 3537 285dc2-285dc7 3528->3537 3534 285cda 3529->3534 3535 285cdc-285cf7 call 2da3a0 3529->3535 3530->3531 3531->3525 3534->3535 3557 285e8e-285e98 3535->3557 3538 285dd1-285de5 3536->3538 3537->3538 3543 285e30-285e32 3538->3543 3544 285de7-285dec 3538->3544 3552 285e64-285e86 3543->3552 3553 285e34-285e62 call 2d8713 3543->3553 3550 285df2-285dfd call 2d8713 3544->3550 3551 286085 Concurrency::cancel_current_task 3544->3551 3546->3513 3556 285d88-285d94 3546->3556 3547->3546 3558 28608a call 2dd60f 3550->3558 3577 285e03-285e2e 3550->3577 3551->3558 3562 285e8c 3552->3562 3553->3562 3556->3516 3563 285d9a-285dae 3556->3563 3564 285e9a-285ea6 3557->3564 3565 285ec6-285eee call 279980 3557->3565 3575 28608f-2860aa call 2dd60f 3558->3575 3562->3557 3563->3516 3572 285ea8-285eb6 3564->3572 3573 285ebc-285ec3 call 2d8375 3564->3573 3581 285f7f 3565->3581 3582 285ef4-285f34 call 286440 3565->3582 3572->3558 3572->3573 3573->3565 3591 2860d8-2860fc call 2867b0 3575->3591 3592 2860ac-2860b6 3575->3592 3577->3562 3584 285f82-285f93 GetModuleHandleW 3581->3584 3598 285f45-285f4f 3582->3598 3599 285f36-285f40 call 27aad0 3582->3599 3589 285fd1 3584->3589 3590 285f95-285fa5 GetProcAddress 3584->3590 3600 285fd3-28605c call 286440 call 2636db call 26372a * 3 call 2d8367 3589->3600 3590->3589 3595 285fa7-285fc5 GetCurrentProcess 3590->3595 3617 2860fe-286106 3591->3617 3618 286144-286149 3591->3618 3596 2860b8-2860c6 3592->3596 3597 2860ce-2860d5 call 2d8375 3592->3597 3595->3589 3640 285fc7-285fcb 3595->3640 3603 2860cc 3596->3603 3604 2861d4-2861d9 call 2dd60f 3596->3604 3597->3591 3598->3584 3607 285f51-285f5d 3598->3607 3599->3598 3602->3516 3610 285c6f-285c7d 3602->3610 3603->3597 3613 285f5f-285f6d 3607->3613 3614 285f73-285f7d call 2d8375 3607->3614 3610->3516 3613->3575 3613->3614 3614->3584 3620 286108-28610c 3617->3620 3621 28613d 3617->3621 3622 28614b-286151 3618->3622 3623 28618f-286197 3618->3623 3628 28611b-286120 3620->3628 3629 28610e-286115 SysFreeString 3620->3629 3621->3618 3633 286188 3622->3633 3634 286153-286157 3622->3634 3630 286199-2861a2 3623->3630 3631 2861c0-2861d3 3623->3631 3636 286132-28613a call 2d8375 3628->3636 3637 286122-28612b call 2d874c 3628->3637 3629->3628 3638 2861a4-2861b2 3630->3638 3639 2861b6-2861bd call 2d8375 3630->3639 3633->3623 3641 286159-286160 SysFreeString 3634->3641 3642 286166-28616b 3634->3642 3636->3621 3637->3636 3638->3604 3646 2861b4 3638->3646 3639->3631 3640->3589 3647 285fcd-285fcf 3640->3647 3641->3642 3649 28617d-286185 call 2d8375 3642->3649 3650 28616d-286176 call 2d874c 3642->3650 3646->3639 3647->3600 3649->3633 3650->3649
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00286067
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00286085
                                                                                                                                                                                                                                              • SysFreeString.OLEAUT32 ref: 0028610F
                                                                                                                                                                                                                                              • SysFreeString.OLEAUT32(00000000), ref: 0028615A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_taskFreeString
                                                                                                                                                                                                                                              • String ID: )$03$43$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
                                                                                                                                                                                                                                              • API String ID: 3597043392-951125482
                                                                                                                                                                                                                                              • Opcode ID: 816a9185a14bf8085686466163729383b1c2ebe2139c87d30a10eee8db3ced7e
                                                                                                                                                                                                                                              • Instruction ID: 08cab3e65ce0fea7628c2ccd6957da56b36e0ed86fefa998f1bc0d3327e92963
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 816a9185a14bf8085686466163729383b1c2ebe2139c87d30a10eee8db3ced7e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5AE123749217449BEB28EF74CC8879DBBB5AF45300F24821CE409AB7C2DB759A94CB91
                                                                                                                                                                                                                                              Function 00296560 Relevance: 25.7, APIs: 14, Strings: 3, Instructions: 211memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 4028 296560-29658d 4029 296599-29659e 4028->4029 4030 29658f-296592 GlobalFree 4028->4030 4031 2965aa-2965af 4029->4031 4032 2965a0-2965a3 GlobalFree 4029->4032 4030->4029 4033 2965bb-2965c8 4031->4033 4034 2965b1-2965b4 GlobalFree 4031->4034 4032->4031 4036 29668c 4033->4036 4037 2965ce-2965d3 4033->4037 4034->4033 4040 29668e-296693 4036->4040 4038 2965d9-2965de 4037->4038 4039 2966cd-2966d1 4037->4039 4043 2965ea-2965ec 4038->4043 4044 2965e0-2965e3 GlobalFree 4038->4044 4041 2966dd-2966ef 4039->4041 4042 2966d3-2966d7 4039->4042 4045 29669f-2966a4 4040->4045 4046 296695-296698 GlobalFree 4040->4046 4050 2966fd-296704 4041->4050 4051 2966f1-2966fb 4041->4051 4042->4041 4049 2967d0-2967d2 4042->4049 4052 29662b-296633 4043->4052 4053 2965ee-2965f0 4043->4053 4044->4043 4047 2966b0-2966b6 4045->4047 4048 2966a6-2966a9 GlobalFree 4045->4048 4046->4045 4054 2966b8-2966b9 GlobalFree 4047->4054 4055 2966bb-2966cc call 2d8367 4047->4055 4048->4047 4049->4040 4058 29670b-29672a 4050->4058 4051->4058 4056 29663f-296641 4052->4056 4057 296635-296638 GlobalFree 4052->4057 4059 2965f3-2965fc 4053->4059 4054->4055 4056->4049 4062 296647-29664c 4056->4062 4057->4056 4058->4036 4069 296730-29676b 4058->4069 4059->4059 4060 2965fe-296618 GlobalAlloc 4059->4060 4060->4036 4063 29661a-296629 call 2dd660 4060->4063 4065 296650-296659 4062->4065 4063->4036 4063->4052 4065->4065 4068 29665b-296675 GlobalAlloc 4065->4068 4068->4036 4071 296677-296686 call 2dd660 4068->4071 4076 29676d-296779 4069->4076 4077 296794-296798 4069->4077 4071->4036 4071->4049 4078 29677b-29677e GlobalFree 4076->4078 4079 296781-296786 4076->4079 4080 29679a-2967a9 call 296a70 call 296af0 4077->4080 4081 2967ae-2967ba 4077->4081 4078->4079 4079->4036 4082 29678c-29678f GlobalFree 4079->4082 4080->4081 4084 2967bc-2967bf GlobalFree 4081->4084 4085 2967c6-2967cb 4081->4085 4082->4036 4084->4085 4085->4049 4086 2967cd-2967ce GlobalFree 4085->4086 4086->4049
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(?), ref: 00296590
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(?), ref: 002965A1
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000101), ref: 002965B2
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(?), ref: 002965E1
                                                                                                                                                                                                                                              • GlobalAlloc.KERNEL32(00000000,?), ref: 0029660D
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000101), ref: 00296636
                                                                                                                                                                                                                                              • GlobalAlloc.KERNEL32(00000000,?), ref: 0029666A
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(?), ref: 00296696
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(?), ref: 002966A7
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(?), ref: 002966B9
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000000), ref: 0029677C
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000000), ref: 0029678D
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000000), ref: 002967BD
                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000000), ref: 002967CE
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Global$Free$Alloc
                                                                                                                                                                                                                                              • String ID: Temp$\$2$`ato
                                                                                                                                                                                                                                              • API String ID: 1780285237-1682427710
                                                                                                                                                                                                                                              • Opcode ID: 0b2dbf05c1f374a6c50623ceda49c77813f33be7a49312fde2c2e5df5b7c33e4
                                                                                                                                                                                                                                              • Instruction ID: 9b2968132c276df40e7c3339b4e0483ed409dc11c42ec9b2bb46f353f826ef35
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0b2dbf05c1f374a6c50623ceda49c77813f33be7a49312fde2c2e5df5b7c33e4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35714E74E1021A9BDF109FA5CC88BAEF7FCAF14704F058559EC01AB241DB79D914CE60
                                                                                                                                                                                                                                              Function 0027CE00 Relevance: 25.0, APIs: 2, Strings: 12, Instructions: 545COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 4089 27ce00-27d2f7 call 2d8713 * 6 call 2c3b8a call 2da920 * 2 call 281770 call 26bbb0 call 26bed0 4114 27d32e-27d3ac call 264300 * 5 call 26ba20 4089->4114 4115 27d2f9-27d30e 4089->4115 4141 27d414-27d41d 4114->4141 4142 27d3ae-27d3b4 4114->4142 4116 27d324-27d32b call 2d8375 4115->4116 4117 27d310-27d31e 4115->4117 4116->4114 4117->4116 4120 27d707-27d71d call 2dd60f call 279c10 4117->4120 4132 27d71f-27d72a call 2d8375 4120->4132 4133 27d72d-27d730 4120->4133 4132->4133 4143 27d454-27d46c call 2da920 call 27ccb0 4141->4143 4144 27d41f-27d434 4141->4144 4145 27d3b6-27d3c5 4142->4145 4146 27d3ed-27d412 4142->4146 4162 27d471-27d481 4143->4162 4147 27d436-27d444 4144->4147 4148 27d44a-27d451 call 2d8375 4144->4148 4150 27d3c7-27d3d5 4145->4150 4151 27d3dd-27d3ea call 2d8375 4145->4151 4146->4143 4147->4148 4153 27d6f8 call 2dd60f 4147->4153 4148->4143 4150->4153 4156 27d3db 4150->4156 4151->4146 4161 27d6fd call 2634d0 4153->4161 4156->4151 4166 27d702 call 2634d0 4161->4166 4164 27d483-27d494 4162->4164 4165 27d4d8-27d4e9 4162->4165 4164->4161 4168 27d49a-27d4a0 4164->4168 4165->4166 4167 27d4ef-27d4f5 4165->4167 4166->4120 4171 27d4f7 4167->4171 4172 27d4f9-27d4fd 4167->4172 4169 27d4a4-27d4a8 4168->4169 4170 27d4a2 4168->4170 4174 27d4ac-27d4d6 call 2640e8 4169->4174 4175 27d4aa 4169->4175 4170->4169 4171->4172 4176 27d501-27d522 call 2640e8 4172->4176 4177 27d4ff 4172->4177 4182 27d527-27d52f 4174->4182 4175->4174 4176->4182 4177->4176 4183 27d597-27d59f 4182->4183 4184 27d531-27d537 4182->4184 4187 27d5a1-27d5b3 4183->4187 4188 27d5f0-27d5f9 4183->4188 4185 27d56a-27d594 4184->4185 4186 27d539-27d548 4184->4186 4185->4183 4189 27d560-27d567 call 2d8375 4186->4189 4190 27d54a-27d558 4186->4190 4187->4188 4191 27d5b5-27d5ca 4187->4191 4192 27d63b-27d689 call 269bb0 call 269940 call 261b84 call 264200 4188->4192 4193 27d5fb-27d604 4188->4193 4189->4185 4190->4120 4195 27d55e 4190->4195 4198 27d5e0-27d5ed call 2d8375 4191->4198 4199 27d5cc-27d5da 4191->4199 4214 27d68d-27d6f7 call 264190 call 26b8a0 call 2c2bfd call 27d740 call 2d8367 4192->4214 4215 27d68b 4192->4215 4193->4192 4194 27d606-27d61b 4193->4194 4200 27d631-27d638 call 2d8375 4194->4200 4201 27d61d-27d62b 4194->4201 4195->4189 4198->4188 4199->4120 4199->4198 4200->4192 4201->4120 4201->4200 4215->4214
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __Mtx_init_in_situ.LIBCPMT ref: 0027D1E6
                                                                                                                                                                                                                                                • Part of subcall function 0026BBB0: std::locale::_Init.LIBCPMT ref: 0026BBFC
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027D6C4
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitIos_base_dtorMtx_init_in_situstd::ios_base::_std::locale::_
                                                                                                                                                                                                                                              • String ID: $+2$$3$.servicebus.windows.net/$/messages?timeout=60&api-version=2014-01$<3$@3$AWS m_url_aws = $Content-Type: application/atom+xml;type=entry;charset=utf-8$`3$https://$u$*2
                                                                                                                                                                                                                                              • API String ID: 655687434-2082713843
                                                                                                                                                                                                                                              • Opcode ID: 554d924c2783efc3f765da6523d521cc662f79868a098afa588a69d06e209c64
                                                                                                                                                                                                                                              • Instruction ID: 9a10c36d72596e123365e8eeb1a974a16a72c8233bcc195bd2fe51269d2889b7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 554d924c2783efc3f765da6523d521cc662f79868a098afa588a69d06e209c64
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7342AD709107458FEB25DF28DD45BA9B7B4FF44308F1086A9E44CAB292EB70AAD4CF50
                                                                                                                                                                                                                                              Function 0027E380 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 271COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E4A1
                                                                                                                                                                                                                                                • Part of subcall function 0027DE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027DF0C
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 0027E3DE
                                                                                                                                                                                                                                                • Part of subcall function 0027E0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E161
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 0027E4FB
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E665
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E6F8
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitMtx_unlockOnce$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID: AdhocTelemetryAzure$Event string is empty$Querying AdhocTelemetryAzure value failed: $SOFTWARE\McAfee\WebAdvisor$]$`3$`3]
                                                                                                                                                                                                                                              • API String ID: 1670716954-2823015103
                                                                                                                                                                                                                                              • Opcode ID: c0b223a8811882d7de5ee60ad85001c0e020560b227ab744c3e07aaa709dd67c
                                                                                                                                                                                                                                              • Instruction ID: f5d46f0bcca42e450299b2e4b9c13df04f17491243094410f1d223000b99955f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c0b223a8811882d7de5ee60ad85001c0e020560b227ab744c3e07aaa709dd67c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5991D671D102189BDF14EF54DD42BEEB3B8EF55314F1045E9E809A7281EB706A68CFA1
                                                                                                                                                                                                                                              Function 00285A23 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 265COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00286085
                                                                                                                                                                                                                                              • SysFreeString.OLEAUT32 ref: 0028610F
                                                                                                                                                                                                                                              • SysFreeString.OLEAUT32(00000000), ref: 0028615A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FreeString$Concurrency::cancel_current_task
                                                                                                                                                                                                                                              • String ID: )$03$43$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
                                                                                                                                                                                                                                              • API String ID: 2663709405-951125482
                                                                                                                                                                                                                                              • Opcode ID: 48638accd47330ac6619f7c8c2f2280e5b2b08f9f14b702fefd0cbe7b83b609a
                                                                                                                                                                                                                                              • Instruction ID: df902ee34b142e747e7f0c27f52cb95a64703494bfa4f27c5343ade04823039d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 48638accd47330ac6619f7c8c2f2280e5b2b08f9f14b702fefd0cbe7b83b609a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 05B125749213588BEF15EFB4C98879DFBB6AF45304F20824CE404AB3D2DB789A94CB51
                                                                                                                                                                                                                                              Function 00274200 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • OpenProcess.KERNEL32(00000400,00000000,?,1CE34B5F,?,?), ref: 00274257
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001,?,?), ref: 002742BC
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002742F2
                                                                                                                                                                                                                                              • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,00000000,?,00000104,00000000,?,?), ref: 00274367
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?), ref: 00274375
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027440A
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?), ref: 0027455B
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Filename for process with id , xrefs: 002744B0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$ErrorInitLastOnceProcess$BeginCloseCompleteFullHandleImageInitializeNameOpenQuery
                                                                                                                                                                                                                                              • String ID: Filename for process with id
                                                                                                                                                                                                                                              • API String ID: 563014942-4200337779
                                                                                                                                                                                                                                              • Opcode ID: f05853cc776926aa82f9c9daee9f885ece4154eb4a86aaa128d8564b22b46e49
                                                                                                                                                                                                                                              • Instruction ID: 71f7a68441221093d17c8e8f2a0ea2e86a8f435bdc9a8eca93317590357121f0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f05853cc776926aa82f9c9daee9f885ece4154eb4a86aaa128d8564b22b46e49
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9AD1A070D20219DBCB20EFA4DC55BEEB7B8FF54304F104669E409A7281EB746A98CF91
                                                                                                                                                                                                                                              Function 003000DE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002FFE25: CreateFileW.KERNEL32(00000000,00000000,?,00300187,?,?,00000000,?,00300187,00000000,0000000C), ref: 002FFE42
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 003001F2
                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 003001F9
                                                                                                                                                                                                                                              • GetFileType.KERNEL32(00000000), ref: 00300205
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0030020F
                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00300218
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00300238
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00300385
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 003003B7
                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 003003BE
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                                                                                              • String ID: is/
                                                                                                                                                                                                                                              • API String ID: 4237864984-394542801
                                                                                                                                                                                                                                              • Opcode ID: 8958cc5a409fa0d40a18046ba3beab2c3a31caf0f9d6366c79f44e59e7cd44d8
                                                                                                                                                                                                                                              • Instruction ID: 03b2ff1164ffb3689eca25e20c76f3568d3f0751cd99d2d4e3c23cb96a2a517e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8958cc5a409fa0d40a18046ba3beab2c3a31caf0f9d6366c79f44e59e7cd44d8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ECA12532A142489FDF1EDF68DC65BAE7BB5AB0A320F144159E811EB3E1CB358D12CB51
                                                                                                                                                                                                                                              Function 00273D80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 188COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WTSGetActiveConsoleSessionId.KERNEL32(0000003C,?), ref: 00273E00
                                                                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(WTSQuerySessionInformation failed to retrieve current user name for the log name.), ref: 00273F9C
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00273FCA
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • WTSQuerySessionInformation failed to retrieve current user name for the log name., xrefs: 00273F97
                                                                                                                                                                                                                                              • WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name., xrefs: 00273F81
                                                                                                                                                                                                                                              • Error retrieving session id for generating log name., xrefs: 00273E0B
                                                                                                                                                                                                                                              • UNKNOWN, xrefs: 00273DD2
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ActiveConcurrency::cancel_current_taskConsoleDebugOutputSessionString
                                                                                                                                                                                                                                              • String ID: Error retrieving session id for generating log name.$UNKNOWN$WTSQuerySessionInformation failed to retrieve current user name for the log name.$WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name.
                                                                                                                                                                                                                                              • API String ID: 1186403813-1860316991
                                                                                                                                                                                                                                              • Opcode ID: c8d648473acc2dc4b11a2759cc9afec858ea445bd172b289ceca3d37cfeea32b
                                                                                                                                                                                                                                              • Instruction ID: a3cf7fa9340f4bdc1b624cafc68f8d85c98a184e94377b05600600091de57cb1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c8d648473acc2dc4b11a2759cc9afec858ea445bd172b289ceca3d37cfeea32b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1F51C371E20216DBCB14DF74CC85BAEBBB8FF08350F20462AE41AD7690D7749A60DB91
                                                                                                                                                                                                                                              Function 002D9900 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00284AA5,00284AA7,00000000,00000000,1CE34B5F,?,00000000,?,002DBE00,0034BF08,000000FE,?,00284AA5,?), ref: 002D9989
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00284AA5,?,00000000,00000000,?,002DBE00,0034BF08,000000FE,?,00284AA5), ref: 002D9A04
                                                                                                                                                                                                                                              • SysAllocString.OLEAUT32(00000000), ref: 002D9A0F
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A38
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A42
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(80070057,1CE34B5F,?,00000000,?,002DBE00,0034BF08,000000FE,?,00284AA5,?), ref: 002D9A47
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A5A
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,?,00000000,?,002DBE00,0034BF08,000000FE,?,00284AA5,?), ref: 002D9A70
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A83
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1353541977-0
                                                                                                                                                                                                                                              • Opcode ID: 77541b6c5d4f5761a436fba7a839b4e2fcb608a746a23d5333db12b6112557b7
                                                                                                                                                                                                                                              • Instruction ID: 73f012692528f19aa3f4eb59810124a7d5831656a4b257bc93adcc1e84c253b1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 77541b6c5d4f5761a436fba7a839b4e2fcb608a746a23d5333db12b6112557b7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0941D472A10245AFDB10DF68DC45BEEBBA8EB49710F10862BF905E7391DB359C50CBA0
                                                                                                                                                                                                                                              Function 0027EEC0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 323COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 0027CCB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027CDBB
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0027F0FC
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027F268
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027F307
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$Concurrency::cancel_current_task
                                                                                                                                                                                                                                              • String ID: AdhocTelemetryAWS$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor$`3
                                                                                                                                                                                                                                              • API String ID: 1722207485-3010751764
                                                                                                                                                                                                                                              • Opcode ID: 0d72804e8020ecde96995a397ef00e41ae1afe447061eef53aef05809c8b165e
                                                                                                                                                                                                                                              • Instruction ID: 0bf35167a56b260d589938d0a935347ab4a36c0b5640b27e569de8b196221e9b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0d72804e8020ecde96995a397ef00e41ae1afe447061eef53aef05809c8b165e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1C1C270D242599BCB14EF64CD45BEEB7B8AF05310F1082A9E419A73C1EB706EA5CF91
                                                                                                                                                                                                                                              Function 00269C50 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 313COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 0026E310: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 0026E36C
                                                                                                                                                                                                                                              • __Mtx_init_in_situ.LIBCPMT ref: 00269DD4
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0026A06D
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DescriptorSecurity$Concurrency::cancel_current_taskConvertMtx_init_in_situString
                                                                                                                                                                                                                                              • String ID: LogLevel$LogRotationCount$LogRotationFileSize$SOFTWARE\McAfee\WebAdvisor$log
                                                                                                                                                                                                                                              • API String ID: 239504998-2017128786
                                                                                                                                                                                                                                              • Opcode ID: 841e2746dd1391ba7bfba288279e58647f727c5736b58a07daa78e3e4e262c0b
                                                                                                                                                                                                                                              • Instruction ID: e616051adb356768a8afb4b7e533145cdf0ba97f2087dd38cba572e5420757a2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 841e2746dd1391ba7bfba288279e58647f727c5736b58a07daa78e3e4e262c0b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1C19C71D202499FDB04DFA4C945BEEBBB4BF48304F204159E405B7291EB75AEA8CF91
                                                                                                                                                                                                                                              Function 0027E0D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 171COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E161
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001), ref: 0027E278
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E351
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • `3, xrefs: 0027E30E
                                                                                                                                                                                                                                              • WinHttpCrackUrl failed for AWS: , xrefs: 0027E268
                                                                                                                                                                                                                                              • Event Sender already initialized for AWS, xrefs: 0027E137
                                                                                                                                                                                                                                              • Unable to open HTTP session for AWS, xrefs: 0027E327
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
                                                                                                                                                                                                                                              • String ID: Event Sender already initialized for AWS$Unable to open HTTP session for AWS$WinHttpCrackUrl failed for AWS: $`3
                                                                                                                                                                                                                                              • API String ID: 2211357200-382156001
                                                                                                                                                                                                                                              • Opcode ID: 4297e4df9b57c5aa6536e0ae8f364e0bc3d6b3a41722055d25b6ced9974d005f
                                                                                                                                                                                                                                              • Instruction ID: 59c4de5ae690209f52c0c7117e1840a0a4d8da8b0addc6bde3326e7a2ac19d2b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4297e4df9b57c5aa6536e0ae8f364e0bc3d6b3a41722055d25b6ced9974d005f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A361A0749107099BDB25DFA0DC45BEEB7B9FB44305F0045ADE819A7280EB707A98CFA1
                                                                                                                                                                                                                                              Function 00276D24 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 166COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __Mtx_init_in_situ.LIBCPMT ref: 00276D7B
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00276F75
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 00276F88
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorMtx_init_in_situMtx_unlockstd::ios_base::_
                                                                                                                                                                                                                                              • String ID: event sender$=$Failed to initialize $async
                                                                                                                                                                                                                                              • API String ID: 3676452600-816272291
                                                                                                                                                                                                                                              • Opcode ID: 7e7e17ab98d587cdef14c0abfc1a53ff82fef6522687f7323f7219eb9bd3ff8c
                                                                                                                                                                                                                                              • Instruction ID: 842d91d9c24368d1a9cf57bc21b2d5c6bb8753a42e83585a70a7523f7667dec1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7e7e17ab98d587cdef14c0abfc1a53ff82fef6522687f7323f7219eb9bd3ff8c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0461D374920705CFDB01DFA0C895BEEBBB5AF44304F54819DD809AB381DB719AA8CFA1
                                                                                                                                                                                                                                              Function 0027DE80 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 147COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027DF0C
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001), ref: 0027DFD7
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E0A2
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Event Sender already initialized for Azure, xrefs: 0027DEE2
                                                                                                                                                                                                                                              • `3, xrefs: 0027E05F
                                                                                                                                                                                                                                              • Unable to open HTTP session for Azure, xrefs: 0027E078
                                                                                                                                                                                                                                              • WinHttpCrackUrl failed for Azure: , xrefs: 0027DFC7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
                                                                                                                                                                                                                                              • String ID: Event Sender already initialized for Azure$Unable to open HTTP session for Azure$WinHttpCrackUrl failed for Azure: $`3
                                                                                                                                                                                                                                              • API String ID: 2211357200-4175200968
                                                                                                                                                                                                                                              • Opcode ID: 5c8f3e5f05c1300c97334a582f6c821469ba4312c67fbcd6eba122412224bc3a
                                                                                                                                                                                                                                              • Instruction ID: 5a412dbe1dbbe7b438bd7ce1ac1901191504b87cbb519123e93c82ebd5d3395e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5c8f3e5f05c1300c97334a582f6c821469ba4312c67fbcd6eba122412224bc3a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9519F749203189FDB21DF60C845BDEB3B8FF14304F00459DE84AA7280EBB4AA98CF91
                                                                                                                                                                                                                                              Function 0027928D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 130COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00278FB0: CoCreateGuid.OLE32(?), ref: 00278FC8
                                                                                                                                                                                                                                                • Part of subcall function 00278FB0: StringFromCLSID.OLE32(?,?), ref: 00278FE0
                                                                                                                                                                                                                                                • Part of subcall function 00278FB0: CoTaskMemFree.OLE32(?), ref: 00279138
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002793D1
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteCreateFreeFromGuidInitializeStringTask
                                                                                                                                                                                                                                              • String ID: Could not set registry value $Could not set registry value InstallerFlags$Failed to create new UUID$InstallerFlags$UUID$]
                                                                                                                                                                                                                                              • API String ID: 598746661-2174109026
                                                                                                                                                                                                                                              • Opcode ID: 0a6e3871d93d61f4da4f98ff554648f309cac08729155ac84b4b6498dfcc3a93
                                                                                                                                                                                                                                              • Instruction ID: f96e6f663b2b241d89662fcb1651fb11f607879d4d288bbc09c6b21351c8a996
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a6e3871d93d61f4da4f98ff554648f309cac08729155ac84b4b6498dfcc3a93
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB519034920309DADF14EF60D896BED7778EF51304F508059F80967281EB74AAE9CFA1
                                                                                                                                                                                                                                              Function 00275790 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,NotComDllGetInterface), ref: 00275808
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?), ref: 00275828
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00275830
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?), ref: 00275839
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FreeLibrary$AddressErrorLastProc
                                                                                                                                                                                                                                              • String ID: NotComDllGetInterface$mfeaaca.dll
                                                                                                                                                                                                                                              • API String ID: 1092183831-2777911605
                                                                                                                                                                                                                                              • Opcode ID: b831cacab44aaf57a0c58f030262055c3be487f1f7967008beeede456c5cdb4a
                                                                                                                                                                                                                                              • Instruction ID: 3fab41f0e033fde3f9a84630d3f029772cbbd3dc28a4bb184376fa81b18a0f92
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b831cacab44aaf57a0c58f030262055c3be487f1f7967008beeede456c5cdb4a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44210332D106399BDB129FA8D8446BEFBB8FF59350F0581A9EC05E3240EBB18D508BD1
                                                                                                                                                                                                                                              Function 00264D63 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00264C8E: GetCurrentProcessId.KERNEL32 ref: 00264CA6
                                                                                                                                                                                                                                                • Part of subcall function 00264C8E: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00264CB8
                                                                                                                                                                                                                                                • Part of subcall function 00264C8E: Process32FirstW.KERNEL32(00000000,?), ref: 00264CD3
                                                                                                                                                                                                                                                • Part of subcall function 00264C8E: Process32NextW.KERNEL32(00000000,0000022C), ref: 00264CE9
                                                                                                                                                                                                                                                • Part of subcall function 00264C8E: CloseHandle.KERNEL32(00000000), ref: 00264CFA
                                                                                                                                                                                                                                              • CreateMutexW.KERNEL32(00000000,00000000,Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}), ref: 00264D88
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00264DD0
                                                                                                                                                                                                                                                • Part of subcall function 0026136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002613A5
                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00264DFC
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32 ref: 00264E0D
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}, xrefs: 00264D7F
                                                                                                                                                                                                                                              • CreateMutex failed: , xrefs: 00264DC2
                                                                                                                                                                                                                                              • SaBsi.cpp, xrefs: 00264DA9
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateHandleInitIos_base_dtorOnceProcess32std::ios_base::_$BeginCompleteCurrentErrorFirstInitializeLastMutexNextObjectProcessSingleSnapshotToolhelp32Wait
                                                                                                                                                                                                                                              • String ID: CreateMutex failed: $Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}$SaBsi.cpp
                                                                                                                                                                                                                                              • API String ID: 2598072538-1117126455
                                                                                                                                                                                                                                              • Opcode ID: 3ca8d495baa7150f1f49b521d572e3e77fba60b3454aa36de880dd821682a47b
                                                                                                                                                                                                                                              • Instruction ID: c705c4aeb83ffd6159b7b38a4a789699cffb5b7ad9230783945f64fff0163103
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ca8d495baa7150f1f49b521d572e3e77fba60b3454aa36de880dd821682a47b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08119130164342ABD725FF20D845BAAB7A8BF55740F104D2CB8D5971D1EBB1A4E8CAA2
                                                                                                                                                                                                                                              Function 0029E580 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 131COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • invalid input, xrefs: 0029E5A3
                                                                                                                                                                                                                                              • NWebAdvisor::XMLParser::ParseBuffer, xrefs: 0029E5AA, 0029E6C3
                                                                                                                                                                                                                                              • Unable to convert XML buffer into wide characters, xrefs: 0029E6BC
                                                                                                                                                                                                                                              • a), xrefs: 0029E6A0
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp, xrefs: 0029E5AF, 0029E6C8
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __cftoe
                                                                                                                                                                                                                                              • String ID: NWebAdvisor::XMLParser::ParseBuffer$Unable to convert XML buffer into wide characters$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp$invalid input$a)
                                                                                                                                                                                                                                              • API String ID: 4189289331-395908528
                                                                                                                                                                                                                                              • Opcode ID: 13cdb4bb7de52e4114ef22656699c29e510c2b5077340b6006461ee05e05db26
                                                                                                                                                                                                                                              • Instruction ID: b19f14f49cbef9fa2054d5c49607a28a7c2162e7888cb68060e9116e8c71fd3f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 13cdb4bb7de52e4114ef22656699c29e510c2b5077340b6006461ee05e05db26
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5241C8B1A11305ABDB14DF54E842BAFF7E4BF14700F41456EE84A9B381DBB4A924CB90
                                                                                                                                                                                                                                              Function 0027CCB0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027CDBB
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID: 5$AdhocAWSQAMode$Querying AdhocAWSQAMode value failed: $SOFTWARE\McAfee\WebAdvisor$`3
                                                                                                                                                                                                                                              • API String ID: 539357862-1137535789
                                                                                                                                                                                                                                              • Opcode ID: c6b0ce9be8758f9f745723d757b26aeae7a992abc72886db3de948f426de7d19
                                                                                                                                                                                                                                              • Instruction ID: d2a5992272ad2910d8994aea8c717873f55a98f08f60f8bd4d4a5724e1773b3d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c6b0ce9be8758f9f745723d757b26aeae7a992abc72886db3de948f426de7d19
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E2316071D202199EDB15EFA4C892BEDB7B8FF14304F504569E409B32C1EB745A58CF61
                                                                                                                                                                                                                                              Function 00265A4F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 81COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 00265A59
                                                                                                                                                                                                                                                • Part of subcall function 00265C1E: CoCreateInstance.OLE32(0032D808,00000000,00000017,0033B024,00000000,1CE34B5F,?,?,?,00000000,00000000,00000000,00308687,000000FF), ref: 00265C7A
                                                                                                                                                                                                                                                • Part of subcall function 00265C1E: OleRun.OLE32(00000000), ref: 00265C89
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 00265B97
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Failed to create Global Options object. Error , xrefs: 00265AA9
                                                                                                                                                                                                                                              • i, xrefs: 00265B5D
                                                                                                                                                                                                                                              • Activation option is set successfuly, xrefs: 00265B69
                                                                                                                                                                                                                                              • Failed to set new option. Error , xrefs: 00265B26
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitOnce$BeginCompleteCreateH_prolog3_InitializeInstanceIos_base_dtor_com_issue_errorstd::ios_base::_
                                                                                                                                                                                                                                              • String ID: Activation option is set successfuly$Failed to create Global Options object. Error $Failed to set new option. Error $i
                                                                                                                                                                                                                                              • API String ID: 1362393928-3233122435
                                                                                                                                                                                                                                              • Opcode ID: 78b4f5000ab72bfd56e182c03a34561154131b912c24a034e360ebfd3ac47956
                                                                                                                                                                                                                                              • Instruction ID: feec983c5e05d5cbb847e9987595e6cb2e4cac0898efb0854e65fd9342624b34
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 78b4f5000ab72bfd56e182c03a34561154131b912c24a034e360ebfd3ac47956
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8C315E70D21629CADF05EBA4CC66BEDB378BF14304F404598E501A7285EF746AA5CFA2
                                                                                                                                                                                                                                              Function 00284B40 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 562COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00285182
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0028521E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_taskIos_base_dtorstd::ios_base::_
                                                                                                                                                                                                                                              • String ID: 83$Invalid arguements passed to AddDimension$N
                                                                                                                                                                                                                                              • API String ID: 4106036149-3151457604
                                                                                                                                                                                                                                              • Opcode ID: 62ec50fdc094737e447d8e2963457ae5e8564ade03ece2fa94e6394ddbb9f5a5
                                                                                                                                                                                                                                              • Instruction ID: 4242547c4babc67dc709799b8c81e61b326f557d90351ba805d55541d3059fb1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 62ec50fdc094737e447d8e2963457ae5e8564ade03ece2fa94e6394ddbb9f5a5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A432EE74D213599FDB24EF64C844B9EBBF1BF45304F148299E448AB292DB74ADA4CF80
                                                                                                                                                                                                                                              Function 002E22D9 Relevance: 9.3, APIs: 6, Instructions: 264COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __allrem.LIBCMT ref: 002E2461
                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E247D
                                                                                                                                                                                                                                              • __allrem.LIBCMT ref: 002E2494
                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E24B2
                                                                                                                                                                                                                                              • __allrem.LIBCMT ref: 002E24C9
                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E24E7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1992179935-0
                                                                                                                                                                                                                                              • Opcode ID: f5f3a44ed8043a2ffd9b201dc5f07ecf71a3fa8d4abf09d185f58aaaf2be2bd1
                                                                                                                                                                                                                                              • Instruction ID: a918a16fdba333261cb08beea81d37aef1d9fb0e3cc1b0a4f9705169740c16bc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f5f3a44ed8043a2ffd9b201dc5f07ecf71a3fa8d4abf09d185f58aaaf2be2bd1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98815B726A0B46DBE724DF2ACC81B6AB3EDAF40760F54412AF512D72C1E770D9198F50
                                                                                                                                                                                                                                              Function 00298650 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 337COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::locale::_Init.LIBCPMT ref: 0029882F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • $+2, xrefs: 002987F3
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp, xrefs: 00298AF6
                                                                                                                                                                                                                                              • Failed to create log message string. Error 0x, xrefs: 002989CF
                                                                                                                                                                                                                                              • *2, xrefs: 002989A7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Initstd::locale::_
                                                                                                                                                                                                                                              • String ID: $+2$Failed to create log message string. Error 0x$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp$*2
                                                                                                                                                                                                                                              • API String ID: 1620887387-3417583179
                                                                                                                                                                                                                                              • Opcode ID: 815ae07f0c7897ade4f987c3b7b405b167a1e0df95182a1446e92f5a68eb65ea
                                                                                                                                                                                                                                              • Instruction ID: a621656edaf76b0ff08714c4098990e4b36d8a1c5d1fa5f00222acb2ce32978e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 815ae07f0c7897ade4f987c3b7b405b167a1e0df95182a1446e92f5a68eb65ea
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 51E16B75E10259CFDF24CF68C885B9EB7B5BF49304F1481AAE409A7280DB74AE94CF90
                                                                                                                                                                                                                                              Function 002707C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __Mtx_destroy_in_situ.LIBCPMT ref: 0027085F
                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 00270903
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?), ref: 00270A26
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 00271020
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 002708FE
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DescriptorSecurity$ConvertFreeLocalMtx_destroy_in_situMtx_unlockString
                                                                                                                                                                                                                                              • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
                                                                                                                                                                                                                                              • API String ID: 4147401711-3078421892
                                                                                                                                                                                                                                              • Opcode ID: 240df336666ce7af4b189850b8d630ddaa508845d7cc0562628228591345034a
                                                                                                                                                                                                                                              • Instruction ID: 65d1c1abd52db799fd1fa7af520ce47220bf475549608e5124f7df48d68e421a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 240df336666ce7af4b189850b8d630ddaa508845d7cc0562628228591345034a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A5610271920254CFDB18CF68CC85BDEB7B5AF45304F0085ADE90A97791D774AAA8CF90
                                                                                                                                                                                                                                              Function 00267F60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __Xtime_get_ticks.LIBCPMT ref: 00267FAA
                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00267FBC
                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00267FD0
                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00267FE2
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Xtime_get_ticks
                                                                                                                                                                                                                                              • String ID: [%Y%m%d %H:%M:%S.
                                                                                                                                                                                                                                              • API String ID: 3638035285-2843400524
                                                                                                                                                                                                                                              • Opcode ID: 250daf90d73d894712c33640bb2acbe1a9b5ecde83efc0e02d0143319b4e87ac
                                                                                                                                                                                                                                              • Instruction ID: 25a09e2640fc247264cdc780383ce26a558487de35e79cbafa97234f711562bf
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 250daf90d73d894712c33640bb2acbe1a9b5ecde83efc0e02d0143319b4e87ac
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 50319271E10214AFDB11DFA4CC82FAEB7B8EB44B10F104629F509AB381DB74A9548B95
                                                                                                                                                                                                                                              Function 00304DB0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 352COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: %s%s$%s\%s$\\?\
                                                                                                                                                                                                                                              • API String ID: 0-2843747179
                                                                                                                                                                                                                                              • Opcode ID: ee4736f8afa2b025568072ed81a7ee48a88ea840aa44b782e222dcd25115298f
                                                                                                                                                                                                                                              • Instruction ID: 23a1dd0d1422cab5f01d072f5c33c9a6ac33427e41907f64809e9f11e04e4871
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee4736f8afa2b025568072ed81a7ee48a88ea840aa44b782e222dcd25115298f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2D1D072D01218DFCF11DFE4C895AEEB7B8EF09310F54052AE915A7281E734AA55CFA1
                                                                                                                                                                                                                                              Function 002A39A0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 270registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\WATesting,00000000,00000001,?,1CE34B5F,00000000,00000001), ref: 002A39FC
                                                                                                                                                                                                                                                • Part of subcall function 002A2820: RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,1CE34B5F,?,?,?), ref: 002A28AC
                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(00000000,?,00000000,811C9DC5,path,00000004,?), ref: 002A3D36
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseInfoOpenQuery
                                                                                                                                                                                                                                              • String ID: SOFTWARE\WATesting$path
                                                                                                                                                                                                                                              • API String ID: 2142960691-1550987622
                                                                                                                                                                                                                                              • Opcode ID: 704554a0bcf4a38785ac8b2fe6df012c3197fec136e0d626da6e81848dc0f430
                                                                                                                                                                                                                                              • Instruction ID: 1ee52ab02dea00f6d04a40134d40133835f9e91f9dd5bdb989a1441a8aec1de1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 704554a0bcf4a38785ac8b2fe6df012c3197fec136e0d626da6e81848dc0f430
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9DB1AE71A10258DFCB25DF64CC49BDEBBB9AF46304F1005D9E409AB291DB70AB98CF60
                                                                                                                                                                                                                                              Function 0029FBE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(?,0033BFD0,00000000,0033BFD0,00000000,?,0000001C,00000001,00000000,0000001C,?,?,00000014,0033BFD0,00000000,1CE34B5F), ref: 0029FC1D
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 0029FC9E
                                                                                                                                                                                                                                              • NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk, xrefs: 0029FC99
                                                                                                                                                                                                                                              • Destination directory does not exist, xrefs: 0029FC8F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                              • String ID: Destination directory does not exist$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp
                                                                                                                                                                                                                                              • API String ID: 3188754299-3555079292
                                                                                                                                                                                                                                              • Opcode ID: 0f29cdefa3e35ff093cb60f2d6cb96a76eeac929f534faa7140ee38428db9db0
                                                                                                                                                                                                                                              • Instruction ID: 030a9443b1e664c3e528f355d9cdd5b28625ac46aa9ee534c7e1656511e7656f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0f29cdefa3e35ff093cb60f2d6cb96a76eeac929f534faa7140ee38428db9db0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F5211975E1021CABCF41DFA8D942AEEB7F4AB48710F11426AFC05A7281DB74AA55CF90
                                                                                                                                                                                                                                              Function 0028CC20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001), ref: 0028CCBB
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0028CCEC
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteErrorInitializeLast
                                                                                                                                                                                                                                              • String ID: P3$Unable to set proxy option, error:
                                                                                                                                                                                                                                              • API String ID: 879576418-3172316252
                                                                                                                                                                                                                                              • Opcode ID: c6e2a3ccbc11f1d289cae360b0e057909efd6f7e5e178947432276cb9a11a66c
                                                                                                                                                                                                                                              • Instruction ID: 03a5f8e48003d61a99d9ed9245d5bbedd1801056933a834fc5808f18e4d5060a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c6e2a3ccbc11f1d289cae360b0e057909efd6f7e5e178947432276cb9a11a66c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9A318D75A10319DFDB21EF60CC05BEEB7B9FB04710F10856EE805A3690EB716A54CBA1
                                                                                                                                                                                                                                              Function 0026DC20 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 553COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 0026E367
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
                                                                                                                                                                                                                                              • API String ID: 0-3078421892
                                                                                                                                                                                                                                              • Opcode ID: 71e6b0f614d4bec03a5f964e2d99cd3d5020f1da500f72329d60be85cc1a9ee7
                                                                                                                                                                                                                                              • Instruction ID: 4b400682b18176498b2ab4f925f972fcd07d1ee1e598a71cb96a45dd32e8162e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 71e6b0f614d4bec03a5f964e2d99cd3d5020f1da500f72329d60be85cc1a9ee7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 93220171A202499BCF14DF64DC89BEDB7B6FF48304F10469EE409A7291DB74AA94CF90
                                                                                                                                                                                                                                              Function 0026E310 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 0026E36C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 0026E367
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DescriptorSecurity$ConvertString
                                                                                                                                                                                                                                              • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
                                                                                                                                                                                                                                              • API String ID: 3907675253-3078421892
                                                                                                                                                                                                                                              • Opcode ID: 7eca20e5d11a0e63b34e0f13f15357ef0507c40240c1c1647cf40cba372f10e7
                                                                                                                                                                                                                                              • Instruction ID: c76f96a7e9f747872a25d58a259764b9ae78baf9a757d44ec947ef762f673e63
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7eca20e5d11a0e63b34e0f13f15357ef0507c40240c1c1647cf40cba372f10e7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AD81CE70A112599BDF24DF24DD88B9DB7B5EF84308F2042D9E009A7291EB79ABD4CF50
                                                                                                                                                                                                                                              Function 002F5FD8 Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F576D: GetConsoleCP.KERNEL32(?,0029860A,00000000), ref: 002F57B5
                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,00000000,0034C218,1CE34B5F,00000000,1CE34B5F,0029860A,0029860A,0029860A,1CE34B5F,00000000,?,002E591E,00000000,0034C218,00000010), ref: 002F6129
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,002E591E,00000000,0034C218,00000010,0029860A), ref: 002F6133
                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 002F6178
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleErrorFileLastWrite__dosmaperr
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 251514795-0
                                                                                                                                                                                                                                              • Opcode ID: a8ff0b6a24daca7d3fde0953018fffcfebac18b7436b717c193e165ebae9162f
                                                                                                                                                                                                                                              • Instruction ID: 2f42499a40ba2df7abfdb339ffcf7e794c7d9f7e3a8d0162aee69ca8c79320a7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a8ff0b6a24daca7d3fde0953018fffcfebac18b7436b717c193e165ebae9162f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6551D17192021EAFEB11DFA4CC49BFEFBB9FF09394F140065E600A7252DA719D618B60
                                                                                                                                                                                                                                              Function 0026E640 Relevance: 4.6, APIs: 3, Instructions: 120COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(00000000,1CE34B5F,0000005C,?,?,?,?,00000000,0030952D,000000FF,?,0026E09D), ref: 0026E681
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(00000000,?,?,?,?,?,00000000,0030952D,000000FF,?,0026E09D), ref: 0026E738
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,00000000,0030952D,000000FF,?,0026E09D), ref: 0026E742
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AttributesCreateDirectoryErrorFileLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 674977465-0
                                                                                                                                                                                                                                              • Opcode ID: f7a5b9d36fa7bf1376644623602bf4c9e4b435c74b34a8cc2c759ca5d8d0bf29
                                                                                                                                                                                                                                              • Instruction ID: 6dae944f99f3218adb1611c3958f33a958923447a965c23837c000346d9448c0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f7a5b9d36fa7bf1376644623602bf4c9e4b435c74b34a8cc2c759ca5d8d0bf29
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 86312679A102089FCF15CF68E984BAEF7B8FF49714F10462EE80593780D735A955CBA0
                                                                                                                                                                                                                                              Function 002C1F70 Relevance: 4.6, APIs: 3, Instructions: 104encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CertGetCertificateChain.CRYPT32(00000000,?,?,?), ref: 002C206C
                                                                                                                                                                                                                                              • CertVerifyCertificateChainPolicy.CRYPT32(00000003,?,?,?), ref: 002C20A4
                                                                                                                                                                                                                                              • CertFreeCertificateChain.CRYPT32(?), ref: 002C20D0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CertCertificateChain$FreePolicyVerify
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1741975133-0
                                                                                                                                                                                                                                              • Opcode ID: 3699b21d8725aad3851d64b94bb4d36c8dc37e73593b2f70a084a6866843cac8
                                                                                                                                                                                                                                              • Instruction ID: 7757d58647dccae2c27c041bd3fb73329fe50c9ce24cad00455e59e81794d3bd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3699b21d8725aad3851d64b94bb4d36c8dc37e73593b2f70a084a6866843cac8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 51417BB1608385DBD720CF54C894B9BBBE8BF99704F04091EF58897250EB76E958CB63
                                                                                                                                                                                                                                              Function 002F6B6C Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,00000000,0029860A,?,002F6A9A,0029860A,0034C5B8,0000000C,002F6B4C,0034C218), ref: 002F6BC2
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,002F6A9A,0029860A,0034C5B8,0000000C,002F6B4C,0034C218), ref: 002F6BCC
                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 002F6BF7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2583163307-0
                                                                                                                                                                                                                                              • Opcode ID: 2bca97f4e10380e3ab0681f20a32b8f0f0fd1f28204852c34e8d9aa53d2dd06a
                                                                                                                                                                                                                                              • Instruction ID: 092375e962c40754b9d8c2ef359faeba728cb2c3ca1a121d7ba3225889d0a2b9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2bca97f4e10380e3ab0681f20a32b8f0f0fd1f28204852c34e8d9aa53d2dd06a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7F016F3253515D1AC5215734E80DF7EE749CF827F8F240279EB1DDB1D2DA718C518681
                                                                                                                                                                                                                                              Function 002F68F6 Relevance: 4.5, APIs: 3, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SetFilePointerEx.KERNEL32(00000000,00000000,?,00000000,002FF765,00000008,00000000,?,?,?,002F69A3,00000000,00000000,?,002FF765), ref: 002F692F
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,002F69A3,00000000,00000000,?,002FF765,?,002FF765,?,00000000,00000000,00000001,?,00000008), ref: 002F6939
                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 002F6940
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2336955059-0
                                                                                                                                                                                                                                              • Opcode ID: d9e27efcf9615cdbc37acb751b5e538ada75e6f40f28b458b11c01ca1b5eea13
                                                                                                                                                                                                                                              • Instruction ID: de76f8c61fe2c850b847bf0d5f93951ad5bd8e05d1aa9196216fa080f4b857b6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d9e27efcf9615cdbc37acb751b5e538ada75e6f40f28b458b11c01ca1b5eea13
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E6014C32620519AFCB059F59DC098BEBB2EEFC6360B340255F911DB290EAB1DD218B50
                                                                                                                                                                                                                                              Function 002B4C69 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: bb6d4def6f4c33f70794296172646923cb6306367b9e66d45ba13a1a4665a798
                                                                                                                                                                                                                                              • Instruction ID: 001987013b3e10b9c31f585da2823b2b2188fbfea78f28303582b28edb4bf0bb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bb6d4def6f4c33f70794296172646923cb6306367b9e66d45ba13a1a4665a798
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 83B012A92B9200FD320521105E06DB7011CC5C0F11B30461FFC00C509198911C6C4071
                                                                                                                                                                                                                                              Function 002B4CAA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 743a6908b59bccff85de0d03c72408bd1b7aae58a2f5e01c294ea2190ec6e3fc
                                                                                                                                                                                                                                              • Instruction ID: 79c3b638e105b25c26a14771410afc1ef98b69109a02d65c477791b1290688bf
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 743a6908b59bccff85de0d03c72408bd1b7aae58a2f5e01c294ea2190ec6e3fc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2EB012952B9100FD328561045E02E77015CC1C0F11B30851FF904C71D1D8811C290031
                                                                                                                                                                                                                                              Function 002B4CBA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 3e1f00450fca1aa52a26c4ef19238dd0e41ef1a3ea87207380d374e0a9e7f4da
                                                                                                                                                                                                                                              • Instruction ID: 0c43c67b5f9ab8874e7b66fe2e7f01f695213c959b65121623b03f11ab0b1bcf
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3e1f00450fca1aa52a26c4ef19238dd0e41ef1a3ea87207380d374e0a9e7f4da
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77B012952B9100FD314561045D02E77015CC5C0F21B30851FFC04C6191D8911C2C0431
                                                                                                                                                                                                                                              Function 002B4C8A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 37a0b23b43b1ad8a3cac09d79e3fe2d76d639dd963af068fe28ea1c79338a779
                                                                                                                                                                                                                                              • Instruction ID: 8d307d6faf7d60300baf721231d56632098dbddb571d6e89f392c1f64c6f5372
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 37a0b23b43b1ad8a3cac09d79e3fe2d76d639dd963af068fe28ea1c79338a779
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D5B012952B9101FD314561049D02E77015CC1C0F21B30891FFC04C71D1D8801C280031
                                                                                                                                                                                                                                              Function 002B4C9A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 6d17df8487e105cd2fbbd43082af5fea147a9c7036a6d6f78f7b3dacdc552055
                                                                                                                                                                                                                                              • Instruction ID: 40ca120ac88c642681d3875c59467dca8a1c736377328731c98f933132f282e3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d17df8487e105cd2fbbd43082af5fea147a9c7036a6d6f78f7b3dacdc552055
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BDB012952B9200FD324561045D02EB7015CC1C0F11B30461FFC04C71D1D8801C6C0031
                                                                                                                                                                                                                                              Function 002B4CEA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 0c3864b8657a5fbff7cf95d64a58749dc397f3a89a7fa805a991ed9cfc67c8a4
                                                                                                                                                                                                                                              • Instruction ID: 6337479d26060f87ca4dd7f15683ab6f57e0c4c65b5315340415ad966cdaac77
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c3864b8657a5fbff7cf95d64a58749dc397f3a89a7fa805a991ed9cfc67c8a4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DFB012952B9100FD328561045F02E7B015DC1C0F11B30851FF804C6191D8811C290032
                                                                                                                                                                                                                                              Function 002B4CFA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 9209571f85839c43c1f9ab9e53e5bf200ee61c8c61b6d307c89b0660395c5b85
                                                                                                                                                                                                                                              • Instruction ID: bdf57b5bd8ca60a8ea449320ce9b2b508b4ff3dc50a3a76b4a7e97657eaa56de
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9209571f85839c43c1f9ab9e53e5bf200ee61c8c61b6d307c89b0660395c5b85
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 84B012952B9100FD314561045E02F7B016DC1C0F11B30451FF804C6191D9801C284032
                                                                                                                                                                                                                                              Function 002B4CCA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 07a635f809b6d42ad5f7eb4041176ee439b80f86084036af4d4a6888b506dd40
                                                                                                                                                                                                                                              • Instruction ID: 7cb7dc716f8eacc3f1d54e93c65a3b823ec2249f11927a91b7bc7a438eb329be
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 07a635f809b6d42ad5f7eb4041176ee439b80f86084036af4d4a6888b506dd40
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 94B012D52B9100FD314561085E02E7B015DC1C0F21B30851FFC04C6191D8C01C280032
                                                                                                                                                                                                                                              Function 002B4CDA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4C81
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: yt
                                                                                                                                                                                                                                              • API String ID: 1269201914-4251244651
                                                                                                                                                                                                                                              • Opcode ID: 6f234a72a9a5f6da48c625a1e8f113d923853b7e4a0868fec28f651c59b91762
                                                                                                                                                                                                                                              • Instruction ID: 2d0cc73cf9844f9b411afb5bd840e3416dae6608950c1f83206d6568d7b8044b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6f234a72a9a5f6da48c625a1e8f113d923853b7e4a0868fec28f651c59b91762
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F7B012952B9200FD324561045E02EBB015DC1C0F11F30461FFC04C61A1D8801C6C0032
                                                                                                                                                                                                                                              Function 002B4D2F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 1d9bc429506e06eb31c62fb4a93cc39ec37a674fc780ce3ae137cef2226f0be9
                                                                                                                                                                                                                                              • Instruction ID: 74d01d6360b759a811af1e3857f46ea4c318a6a0eeb6e7b633faf81fd118e37a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1d9bc429506e06eb31c62fb4a93cc39ec37a674fc780ce3ae137cef2226f0be9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEB012852B8111FC35856204DD02E77039CC1C8B31330861FFC05C6391D8801C585031
                                                                                                                                                                                                                                              Function 002B4D25 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: d98bb5b62daaac5a69f13b7647a68f59adc5bf76b9f3ddded3bbbbb98273089e
                                                                                                                                                                                                                                              • Instruction ID: 623b5dbebf19978b7c3e2d56c078229cc14f8671a96bed1b388a3ad91c8574cc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d98bb5b62daaac5a69f13b7647a68f59adc5bf76b9f3ddded3bbbbb98273089e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 55B012853B8101FD318561049D02FB702ACC1C4B11330451FFC04C6391D8801C589031
                                                                                                                                                                                                                                              Function 002B4D39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 5d9d83fdd71fe675535ecc1e3a185ff0fcc79438eef8423c9f85407d7baab1f0
                                                                                                                                                                                                                                              • Instruction ID: 8a87ddbb34129210e01dcf63f3c73153d1d5d5a15a631959b3a90d7498f0497e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5d9d83fdd71fe675535ecc1e3a185ff0fcc79438eef8423c9f85407d7baab1f0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1AB012852B8201FC32856204DD42EB7029CC1C4B21330471FFC05C6391D8842C9C5031
                                                                                                                                                                                                                                              Function 002B4D0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 78904de82b735b9bd855539e101635beb5fdb3a6fdc7097dac96bc1ca8dcc271
                                                                                                                                                                                                                                              • Instruction ID: aeaf84d7a8d61ac5e9afa658e37113f746abd7b0b9c6eb4af2cdcdcf07debbf1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 78904de82b735b9bd855539e101635beb5fdb3a6fdc7097dac96bc1ca8dcc271
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ACB012853B8142FC328521009E02D77025CC1C0B11330851FFC00C5292D8801C595031
                                                                                                                                                                                                                                              Function 002B4D6B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 442a27542d606bec70a18cd01d5df1924fbed15fdac5e0b0fb038a8f221b7961
                                                                                                                                                                                                                                              • Instruction ID: 941f8c9331c3fd72402e3d8ff653f3d5fdc45d5c4c3273e544922abde73ab427
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 442a27542d606bec70a18cd01d5df1924fbed15fdac5e0b0fb038a8f221b7961
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 74B012853B8201FC328561049D02EB7029CC1C4B11730461FFC04C6391D8841C9C5031
                                                                                                                                                                                                                                              Function 002B4D61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 4ef732c5621bda156f9b560979b6547be7dbfeabd13437b3ce4148ca877a14eb
                                                                                                                                                                                                                                              • Instruction ID: 1915bc6c3c54d57eab26b0e7dbfdf0d02f97107307038d10de12f54ed1866069
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4ef732c5621bda156f9b560979b6547be7dbfeabd13437b3ce4148ca877a14eb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FEB012852B8211FC35856104DD42E77029CC1C4B21330851FFC04C6391D8801C585031
                                                                                                                                                                                                                                              Function 002B4D7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 3092c4753d92a7c9509e3664c43ee7d7da90921cff0fc62fc3fc3a518e33dc2a
                                                                                                                                                                                                                                              • Instruction ID: 123fc2c85a41e6219e96d7b859f51cd5873680c7f6f0fa04d96cc1c92b3820fc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3092c4753d92a7c9509e3664c43ee7d7da90921cff0fc62fc3fc3a518e33dc2a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36B012852F8201FC31856105DD42F7702ACC1C4B11330451FFC04C6391D9801C589131
                                                                                                                                                                                                                                              Function 002B4D75 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 716be3cf7a3a77bdf913b68d3b1483788aabd813c9e53a387e33e94de9070ed5
                                                                                                                                                                                                                                              • Instruction ID: 072d47748c5f6a99194311ca10c4d292853756311cc99ac2613f321d016ed77f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 716be3cf7a3a77bdf913b68d3b1483788aabd813c9e53a387e33e94de9070ed5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EBB012C52B9111FC35856104DD02E77029CC1C4B21330C51FFC04C6391D8801C5C5031
                                                                                                                                                                                                                                              Function 002B4D4D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 6daccb47fa6f416093cd88d9a7b03e8e251d823a557384607696268157f233b1
                                                                                                                                                                                                                                              • Instruction ID: 2075053954bb295c4364050a75ed34739c1e120ad41576ee692c1fdb37a2e9a5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6daccb47fa6f416093cd88d9a7b03e8e251d823a557384607696268157f233b1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 87B012853B8111FC368561049D02E7702ACC1C4B21330851FFC04C7391D8801C5C5031
                                                                                                                                                                                                                                              Function 002B4D43 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 41a950ad52c9cf0e016e05eb7686b97312bd9fe3616874c2b7eac9d2a77381f1
                                                                                                                                                                                                                                              • Instruction ID: bd4c3cb1815be765bc174d6ec9553dfe3066be4e6a6e13e2b57e91c90026d66b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 41a950ad52c9cf0e016e05eb7686b97312bd9fe3616874c2b7eac9d2a77381f1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D4B012852B8101FC36C56204DE02E77029DC1C4B21370871FFC05C6391D8801C595031
                                                                                                                                                                                                                                              Function 002B4D57 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 791cb63eb6e0096003807ba3496284f2423da0b3931702c42e8e085a559a7929
                                                                                                                                                                                                                                              • Instruction ID: f60a5a285f0f1eb470a4196ba4bb147c65a9fa140229ba86c7edb66491aae813
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 791cb63eb6e0096003807ba3496284f2423da0b3931702c42e8e085a559a7929
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2CB012852B8101FC31856204DD02F7B02ACC1C4B21330471FFC05C6391D8801C589031
                                                                                                                                                                                                                                              Function 002B4D89 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: 409c8a527aadb6187df5ec77b6d93edeb398d5bc6c770ca1d71e028b6e7d7a8f
                                                                                                                                                                                                                                              • Instruction ID: 32d5fd0a20a6f2526e0df3f09ffd95a33704cc21b1042c575cef42cafcd86453
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 409c8a527aadb6187df5ec77b6d93edeb398d5bc6c770ca1d71e028b6e7d7a8f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 83B012852B8301FC32C56104EE42E77029CC1C4B11330851FFC05C6391D8801C595031
                                                                                                                                                                                                                                              Function 002B4D93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4D1C
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID: `ato
                                                                                                                                                                                                                                              • API String ID: 1269201914-3307817267
                                                                                                                                                                                                                                              • Opcode ID: ade45d4c013bc3f88c285329505700d4a3092764b19134e8a99deb26f5d4c469
                                                                                                                                                                                                                                              • Instruction ID: 284ca45e8ced33e3824140237f84058b865a08eeba985a33d888ac626d1ae38d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ade45d4c013bc3f88c285329505700d4a3092764b19134e8a99deb26f5d4c469
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8AB012852B8301FC36856104DD42EB7029CC1C4B11330461FFC04C6391D8841C9C9031
                                                                                                                                                                                                                                              Function 00284A40 Relevance: 3.1, APIs: 2, Instructions: 90COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 00284AD2
                                                                                                                                                                                                                                              • SysFreeString.OLEAUT32(-00000001), ref: 00284AFD
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FreeString_com_issue_error
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 709734423-0
                                                                                                                                                                                                                                              • Opcode ID: 25c90cacd6ca0f27013e219183994190e79a2405ea4e6eb9b6ef0a7ae98a2fdb
                                                                                                                                                                                                                                              • Instruction ID: 06aa9d98add8a9c0062a4fbbf0f19fe846f6c9315fd76fc50a01f14ca0317778
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 25c90cacd6ca0f27013e219183994190e79a2405ea4e6eb9b6ef0a7ae98a2fdb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3321F7B5911712ABE320AF54C801B5BF7E8EF40B20F24471EF815973C0E7B4A850CB90
                                                                                                                                                                                                                                              Function 002F5BF0 Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,?,?,00000000,?,0029860A,00000000,?,002F610D,0029860A,0029860A,00000000,0034C218,1CE34B5F,0029860A), ref: 002F5C8C
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,002F610D,0029860A,0029860A,00000000,0034C218,1CE34B5F,0029860A,0029860A,0029860A,1CE34B5F,00000000,?,002E591E,00000000,0034C218), ref: 002F5CB2
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 442123175-0
                                                                                                                                                                                                                                              • Opcode ID: cda5c09bc05518a7a86ea9180463afa7e6f53095c45da917c99429700440f5e7
                                                                                                                                                                                                                                              • Instruction ID: 24d31a7f55f5d9bbb7c6ef2023fdc6d236374884fd0a02554aefcbd263e0d9fe
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cda5c09bc05518a7a86ea9180463afa7e6f53095c45da917c99429700440f5e7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B1218030A106299FCB16CF29DC80AE9B7BAEB48341F1440BAEA46D7311D630DE528F60
                                                                                                                                                                                                                                              Function 00269BB0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                              • InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitOnce$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 51270584-0
                                                                                                                                                                                                                                              • Opcode ID: 635d2c1376b3b1bd12beab18ca793abad5f6210b563f916e1866b6441b584633
                                                                                                                                                                                                                                              • Instruction ID: 4e9d0e26e17fcf33b43a134a4874ea332542c5013fb53b5a36a797ba521f52ac
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 635d2c1376b3b1bd12beab18ca793abad5f6210b563f916e1866b6441b584633
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4F01D270A40649AFEB15EF94CC06FAEB7B8FB08B04F10062AF915AB2C0DF745948CA51
                                                                                                                                                                                                                                              Function 002D99E1 Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00284AA5,?,00000000,00000000,?,002DBE00,0034BF08,000000FE,?,00284AA5), ref: 002D9A04
                                                                                                                                                                                                                                              • SysAllocString.OLEAUT32(00000000), ref: 002D9A0F
                                                                                                                                                                                                                                                • Part of subcall function 002DE960: _free.LIBCMT ref: 002DE973
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A38
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A42
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(80070057,1CE34B5F,?,00000000,?,002DBE00,0034BF08,000000FE,?,00284AA5,?), ref: 002D9A47
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A5A
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,?,00000000,?,002DBE00,0034BF08,000000FE,?,00284AA5,?), ref: 002D9A70
                                                                                                                                                                                                                                              • _com_issue_error.COMSUPP ref: 002D9A83
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _com_issue_error$ErrorLast$AllocByteCharMultiStringWide_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 878839965-0
                                                                                                                                                                                                                                              • Opcode ID: 437c50463098c11450f77cf60dfdf6dddc35cfb7610ec7f1d80c29eeeeb11e55
                                                                                                                                                                                                                                              • Instruction ID: aec9c74ede1b374ed7a43b6a8ea5ef29b4c14538cca6e75e653d36092abce123
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 437c50463098c11450f77cf60dfdf6dddc35cfb7610ec7f1d80c29eeeeb11e55
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CD014B72B152599BDB209F949846BEEB7A8EB48720F10412AFE0567391DA715C608BA0
                                                                                                                                                                                                                                              Function 0028DEC0 Relevance: 3.0, APIs: 2, Instructions: 22registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SHDeleteKeyW.SHLWAPI(?,0033BFD0,?,0028DE7B), ref: 0028DED6
                                                                                                                                                                                                                                              • RegCloseKey.KERNEL32(?,?,0028DE7B), ref: 0028DEE4
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseDelete
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 453069226-0
                                                                                                                                                                                                                                              • Opcode ID: ef533009e945e600219e4d9a706d91333b75a593349242e815c9aae252684e92
                                                                                                                                                                                                                                              • Instruction ID: 127e9992da63a64f14eb1ec20a288df64948ee06ea074239c2157fae0398485d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef533009e945e600219e4d9a706d91333b75a593349242e815c9aae252684e92
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C7E01A74505B518FD731DF29E848B83BBE8AB08710F04C84DE89AC7A94C3B8E844CB54
                                                                                                                                                                                                                                              Function 0026DEB0 Relevance: 1.8, APIs: 1, Instructions: 298COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000023,00000001,1CE34B5F,?,?), ref: 0026DF08
                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 0026E36C
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DescriptorSecurity$ConvertFolderPathSpecialString
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4077199523-0
                                                                                                                                                                                                                                              • Opcode ID: cc095c8608bc7aab74c7f81f5cf3704c9bd18df8c3e3cc9d26eef23c81ea1fa2
                                                                                                                                                                                                                                              • Instruction ID: bb53b6451688bd125b36342a2691d9c838d6dcc52262641e548c6799eccda6d7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cc095c8608bc7aab74c7f81f5cf3704c9bd18df8c3e3cc9d26eef23c81ea1fa2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 15C10135A202059BCF28DF28DC8979DB7B6FF85304F10869DD409A7691DB71AAE4CF90
                                                                                                                                                                                                                                              Function 002F627A Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 6be8b1e7839e36ab34cd077a3923981bb6c3dd25774bea0c8bf18c124015fe25
                                                                                                                                                                                                                                              • Instruction ID: 885b0cce65c589d9ed908b942f085ca12dd92404d1e37f6ef322905494bfdf58
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6be8b1e7839e36ab34cd077a3923981bb6c3dd25774bea0c8bf18c124015fe25
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E3411774A2010CAFDB04DF58C889ABDBBB2EB857A4F2881B8F6449B351C772DD51CB50
                                                                                                                                                                                                                                              Function 002F732A Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __wsopen_s
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3347428461-0
                                                                                                                                                                                                                                              • Opcode ID: f0dd12fe1471de6a6d667377d7d06b796cfa8dfd1338e4305bc3ac9a5c02fb7d
                                                                                                                                                                                                                                              • Instruction ID: 833b9a77b28d437fa9501834087b646d5abc03896164f3a2b99b14b23e9b8379
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f0dd12fe1471de6a6d667377d7d06b796cfa8dfd1338e4305bc3ac9a5c02fb7d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B112A75A0420AAFCF05DF58E94199F7BF5EF48304F0540A9F905EB351D630EA21DBA5
                                                                                                                                                                                                                                              Function 002E5854 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
                                                                                                                                                                                                                                              • Instruction ID: 7f703c07d781a01796631bbf935b68df15b9f5bd30e499499f516d6a06d4b67b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 95F049365B1E285AEA217A3A8C0566B7358CF42378F500325F961931D2CA70D8668E91
                                                                                                                                                                                                                                              Function 0028DF10 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegCreateKeyExW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?), ref: 0028DF45
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Create
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2289755597-0
                                                                                                                                                                                                                                              • Opcode ID: b3067bdddaa20c3099b4ee6e73e818c6e9463792f432046ffe92df8e603bae02
                                                                                                                                                                                                                                              • Instruction ID: 113d2f3b1f70dd21410a84bdde883fe0d0a5a5988b0b876c7477ae7f75d25f44
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3067bdddaa20c3099b4ee6e73e818c6e9463792f432046ffe92df8e603bae02
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 51012C75500209EBCB25CF45D804F9EBBB9FF99310F108059FD4597350D771AA64DB94
                                                                                                                                                                                                                                              Function 002A6050 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • PathFileExistsW.SHLWAPI(?), ref: 002A6061
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExistsFilePath
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1174141254-0
                                                                                                                                                                                                                                              • Opcode ID: 7a11b03544682da9d5dd0169d914521dbd28d3ed3221a5c5c9d9e76d9029a3f8
                                                                                                                                                                                                                                              • Instruction ID: 04eb211144f231cabf0b09b80dd7c673eb1940032ea0c39436dec444d83d2cd8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a11b03544682da9d5dd0169d914521dbd28d3ed3221a5c5c9d9e76d9029a3f8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98F06D352102008FC714DF69D858B5BBBF9EF89710F05851DE849CB620DB75F951CBA0
                                                                                                                                                                                                                                              Function 002F55F5 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F2174: RtlAllocateHeap.NTDLL(00000000,?,?,?,002D872D,?,?,0026A1ED,0000002C,1CE34B5F), ref: 002F21A6
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F5615
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: RtlFreeHeap.NTDLL(00000000,00000000,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?), ref: 002F20AE
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: GetLastError.KERNEL32(?,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?,?), ref: 002F20C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Heap$AllocateErrorFreeLast_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 314386986-0
                                                                                                                                                                                                                                              • Opcode ID: 7784cbed2e3b8b917f5f89aa9cf4cdf2a5875f07106d4ff91f005c69dcaeb4c8
                                                                                                                                                                                                                                              • Instruction ID: 20f0fd7fe373a3fff18bb330a29efa0bb806340870a107264c906a7d966218b6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7784cbed2e3b8b917f5f89aa9cf4cdf2a5875f07106d4ff91f005c69dcaeb4c8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8F0CD721107048FD3258F45D802BA2F3FCEF80B21F10843FE3AA8B6A0DAB0A4458B94
                                                                                                                                                                                                                                              Function 002F2174 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,?,?,002D872D,?,?,0026A1ED,0000002C,1CE34B5F), ref: 002F21A6
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                                                                              • Opcode ID: 5bc6bafa1cba101a4ccb5bf34fa2876f0b4499257d5ea3354e8d56aa0c8b4d98
                                                                                                                                                                                                                                              • Instruction ID: 568eb291c8df350a86652921969f2da46ee6a09c5d48cf0034eb285fc3f063ed
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5bc6bafa1cba101a4ccb5bf34fa2876f0b4499257d5ea3354e8d56aa0c8b4d98
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C0E0ED3123022EE7E7312A699C00BBBF65CDF433E1F504130AF1CA6192CB60CC6885A8
                                                                                                                                                                                                                                              Function 0028E500 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegOpenKeyExW.KERNEL32(?,?,00000000,?,?), ref: 0028E51F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Open
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 71445658-0
                                                                                                                                                                                                                                              • Opcode ID: cd2b23e7896b89b49d5779bae299f44c386515bbbe5c4de29504f951b546c053
                                                                                                                                                                                                                                              • Instruction ID: 604195712662a5b9737ad7737e82a08c3b55d31bdecfffa58afcfe5093de4331
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cd2b23e7896b89b49d5779bae299f44c386515bbbe5c4de29504f951b546c053
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08F05E31601208ABDB25CF0ADC04F9EBBACEF98710F10845EF80597250D6B5AA108B94
                                                                                                                                                                                                                                              Function 0026136C Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002613A5
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 323602529-0
                                                                                                                                                                                                                                              • Opcode ID: 1b99b50d6e54250a58375499777e40ebb8323cbddaba5499811c9f4fbac87ad8
                                                                                                                                                                                                                                              • Instruction ID: 4fde91e822e0a5c0fcdddc3aca1c053f59cebf311a7bb19030879ae5f447bdd4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b99b50d6e54250a58375499777e40ebb8323cbddaba5499811c9f4fbac87ad8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 11F06D76914658EFD706DF48DC01F9AB3ECEB09B24F10462EF81293680DFB979048A94
                                                                                                                                                                                                                                              Function 0028ED10 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegSetValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 0028ED2F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 3939c1a7206902f855a14471a9d69429881619fc75e25f008df5be512d2f277e
                                                                                                                                                                                                                                              • Instruction ID: 28c14322bcb385eba8a5f9f154e6a97ad1579c06fed66b1efde9b811a38f6fab
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3939c1a7206902f855a14471a9d69429881619fc75e25f008df5be512d2f277e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57E0123925010DEBDF019E85EC40FA77B2EEB94700F14C415F9184A195D373DC31ABA0
                                                                                                                                                                                                                                              Function 00304D80 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(00000000,?,00304E6A,00000000,00000000,-00000002,1CE34B5F,00000028,00000000,?,00000000,extra,00000005,00000000,00000000,003244E4), ref: 00304D92
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3188754299-0
                                                                                                                                                                                                                                              • Opcode ID: b4018a74aaa5772a6add2c91ac9bbde98d7e89c25e5c578f6bed8636528eeeda
                                                                                                                                                                                                                                              • Instruction ID: 8b00414818a29f6e02559d479d41bec9a6cc299fea4bde161d4a7fa79de48a2f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b4018a74aaa5772a6add2c91ac9bbde98d7e89c25e5c578f6bed8636528eeeda
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4ED0A7B111120839EF550E7CB4796B6334C994176474D0650F91EC60D6E631EDB29310
                                                                                                                                                                                                                                              Function 002FFE25 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(00000000,00000000,?,00300187,?,?,00000000,?,00300187,00000000,0000000C), ref: 002FFE42
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                                                              • Opcode ID: 0c25a27b144b6732aa44d9c8c23406fbbf9d8f07d3a3fedb1a8129fa63f62da5
                                                                                                                                                                                                                                              • Instruction ID: ed3e44c8e90f1ad0b8f76490111c4dadfe404c7ae42d8f6e0d1f420d057790fb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c25a27b144b6732aa44d9c8c23406fbbf9d8f07d3a3fedb1a8129fa63f62da5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23D06C3200010DBBDF028F85DD06EDA3BAAFB4C714F018000FE1856060C772E921AB91
                                                                                                                                                                                                                                              Function 002C269D Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002C2743: DloadGetSRWLockFunctionPointers.DELAYIMP ref: 002C2743
                                                                                                                                                                                                                                                • Part of subcall function 002C2743: AcquireSRWLockExclusive.KERNEL32(?,002C28F1), ref: 002C2760
                                                                                                                                                                                                                                              • DloadProtectSection.DELAYIMP ref: 002C26C5
                                                                                                                                                                                                                                                • Part of subcall function 002C286C: DloadObtainSection.DELAYIMP ref: 002C287C
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Dload$LockSection$AcquireExclusiveFunctionObtainPointersProtect
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1209458687-0
                                                                                                                                                                                                                                              • Opcode ID: 32e9fd6fcee097431ba269b83e2ac03d1cc0f9ee367380e804abbcfd2135631b
                                                                                                                                                                                                                                              • Instruction ID: 184cc023948c71399cb2ff31ef3524fea12cb709ac3edd2c5f6bd71cd9182ce1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 32e9fd6fcee097431ba269b83e2ac03d1cc0f9ee367380e804abbcfd2135631b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F0D0C930E38751CAC252BF15AC87F542258B744746FB0461DA505820B4CFB1486D9E35
                                                                                                                                                                                                                                              Function 0028E8C0 Relevance: 1.5, APIs: 1, Instructions: 11registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegQueryValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 0028E8D4
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: QueryValue
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3660427363-0
                                                                                                                                                                                                                                              • Opcode ID: 26f41012b372c581237c82ce00d7fd79e1b543da45e7025e562852cf0673d008
                                                                                                                                                                                                                                              • Instruction ID: ff853550cb16615bf7a44c149aa736b7f5072889e677d1ae8aa21140f572c750
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 26f41012b372c581237c82ce00d7fd79e1b543da45e7025e562852cf0673d008
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 15D0EA3604020DBBDF025F81ED05EDA7F2AEB09761F148415FA1918061C7B39571EBA5
                                                                                                                                                                                                                                              Function 002DE960 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002DE973
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: RtlFreeHeap.NTDLL(00000000,00000000,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?), ref: 002F20AE
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: GetLastError.KERNEL32(?,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?,?), ref: 002F20C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1353095263-0
                                                                                                                                                                                                                                              • Opcode ID: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
                                                                                                                                                                                                                                              • Instruction ID: a15e1b1f596cb4fd4a0711d78f9bb3a9e5451db53553bda1d3b58ad32dee4b31
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 31C08C3200020CFBCB009B41C806E4EBBA8DB803A4F200058F40127340CAB1EE089A80
                                                                                                                                                                                                                                              Function 002B4DB8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4DAF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 27b08dd5af46c29f930e59bd33a015d53f5603fa6d3b6a0af685759e57181a1e
                                                                                                                                                                                                                                              • Instruction ID: 9dcccb7d25de48676793cdcc30dda9efde518098209a97b5f630bd18078a75a6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 27b08dd5af46c29f930e59bd33a015d53f5603fa6d3b6a0af685759e57181a1e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BBB012C52F8101FC318561146D02E77015CC2C4B21330852FFC48C71A1D8805C1C0031
                                                                                                                                                                                                                                              Function 002B4D9D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002B4DAF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 61889316a0350a0a81f2d6561d96eb36acc5eb6a75c623bd0a8309fe389a1dbc
                                                                                                                                                                                                                                              • Instruction ID: 2de74f04246f87381e9410aa54fb6673f1481701b3807a2d936df5cc4643d36b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 61889316a0350a0a81f2d6561d96eb36acc5eb6a75c623bd0a8309fe389a1dbc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99B012C52F9101FC31452100AD02E77021CC6C1B517B0451FFC80C50A199905C1C4031
                                                                                                                                                                                                                                              Function 002C14C6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002C14D8
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 70d10e59139af01227d8b112dfd6456ad951b523b7e0fcfae74b70f433c91849
                                                                                                                                                                                                                                              • Instruction ID: 5cc563e86746a3531ebb124aee2b05d1fd9248d661a224190ad9a92f9795c3a9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 70d10e59139af01227d8b112dfd6456ad951b523b7e0fcfae74b70f433c91849
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 69B012A52B8100FC324921119E03F37114CC1C1B12730C61FF804C7091E8806C291031
                                                                                                                                                                                                                                              Function 002D97AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D97C4
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 502152579d6f6b97381681b5801c419d288d5f711471f43ef3faaa04a9d6cf31
                                                                                                                                                                                                                                              • Instruction ID: 68c441e07a1fe36e24cbe344d5462b88ba0e0048503927575222b8798eff5018
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 502152579d6f6b97381681b5801c419d288d5f711471f43ef3faaa04a9d6cf31
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DEB012D52B8100FC324531145E02D37011CC1C0B11330C92FFC00D6191A8802C5D4431
                                                                                                                                                                                                                                              Function 002D9BFA Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: e54239a620cf910fd1eed0a0e80c094ff2270f23dc9f394757754b663fb07bb6
                                                                                                                                                                                                                                              • Instruction ID: d52b5b41c93cd26b785dbc8c701abc2db752fb74254412c7ca80bebf82ad50c6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e54239a620cf910fd1eed0a0e80c094ff2270f23dc9f394757754b663fb07bb6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77B012953BC100FC314591086D02E37029CC1C0B213718A1FFC05CA291E8801CD81031
                                                                                                                                                                                                                                              Function 002D9BF0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 20813b789ecc10062d04a7a781d0c59c104b86b23850dfe15e7997ea96873fed
                                                                                                                                                                                                                                              • Instruction ID: a16f5dc4b8bd285a875459c291a99e70c3d061adb8ea13ca93b01af038a25885
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 20813b789ecc10062d04a7a781d0c59c104b86b23850dfe15e7997ea96873fed
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 12B012953BC100FC328591086E02E37114CC1C0B113718A1FF805CA291F8801CD91031
                                                                                                                                                                                                                                              Function 002D9C2C Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: d08ee880ef76dc553582c30d356eda48088add860a511580788097c0769e3c9b
                                                                                                                                                                                                                                              • Instruction ID: 8068f13b029850ddf698f5e61da58f9575aea53cfc64cd79b6f68b924c4ef80e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d08ee880ef76dc553582c30d356eda48088add860a511580788097c0769e3c9b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2DB012863BC200FC31459108AD02F37019CC1C0B113304A1FF806CE291E8801C985031
                                                                                                                                                                                                                                              Function 002D9C22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: e403052751ce034c76ab0eaadc784c5723309880163d25766ee6c334ae18b213
                                                                                                                                                                                                                                              • Instruction ID: 37f8c4424956888b86e3650a8d98114615bceff977b257acbf372f6b66d1f4c7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e403052751ce034c76ab0eaadc784c5723309880163d25766ee6c334ae18b213
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 03B012953BC100FC32859108AE02E3711CCC1C0B117308A1FF805CE291E8801C991031
                                                                                                                                                                                                                                              Function 002D9C36 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 26f0c8d640c14dc644991026ef89a6c1874c5795a983343e3db0e0428bea3cc8
                                                                                                                                                                                                                                              • Instruction ID: 2bc3e3cc4b340cdc120f136f369904159982b02f622e08595eba9889290d4f7c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 26f0c8d640c14dc644991026ef89a6c1874c5795a983343e3db0e0428bea3cc8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 31B012853BC140FC314591086D02F37014CC1C0B213308A1FFC05CA291E8805C983031
                                                                                                                                                                                                                                              Function 002D9C0E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: f4ffa5a5ac958944380654466c415ed682bdde1c6628ed908de6edb4cfc22df6
                                                                                                                                                                                                                                              • Instruction ID: 0b80ce370868e635a3e0fe76d46742e39f54b2cf1c874ca04e8f58abd44ae50e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f4ffa5a5ac958944380654466c415ed682bdde1c6628ed908de6edb4cfc22df6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27B012853BC100FC35459118AD02E37018CC1C0B213308A1FFC05CE291E8801C981031
                                                                                                                                                                                                                                              Function 002D9C04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 6e59d2a24af58c277246f6846e686a5f9c4a2d4cba4e2ea113f9064713e3dd41
                                                                                                                                                                                                                                              • Instruction ID: 138dcf05f3de9a6de3bf21023562aa248e42c505e5b6a9f08116b2f650db8eaf
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e59d2a24af58c277246f6846e686a5f9c4a2d4cba4e2ea113f9064713e3dd41
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C6B012953BC100FC314591086D02F37015CC2C0B113714A1FF805CA291F8801CD89031
                                                                                                                                                                                                                                              Function 002D9C18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 2b07250b3920e8f6aa6598ccc40bf5a47632db8f00e48203ab585e102d1856da
                                                                                                                                                                                                                                              • Instruction ID: e0dd428ceba8776cf707b682aa2731cf2c743123984ab700614000cdcb5fb284
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b07250b3920e8f6aa6598ccc40bf5a47632db8f00e48203ab585e102d1856da
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 19B012893BC200FC32459108AD02E77018CC1C0B113304B1FFC05CE291E8801CDC1031
                                                                                                                                                                                                                                              Function 002D9C4A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 0c6268859770c249b90d74caf62679a856d5a04e87f73ffd6ed1ef4cee4de3dd
                                                                                                                                                                                                                                              • Instruction ID: c73095614fdc9ff55a6a44eb228afcab20b423bf99aa9f601f7ff9dcabc23c04
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c6268859770c249b90d74caf62679a856d5a04e87f73ffd6ed1ef4cee4de3dd
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0B012853BC140FC32859108AE02F37114CC1C0B113308A1FF805CA2A1E8801C993031
                                                                                                                                                                                                                                              Function 002D9C40 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 8f4686aeac4fae0154d7f7f7ea803edcd7c9895c3b5c03a5df679420bbf5d9c1
                                                                                                                                                                                                                                              • Instruction ID: ed5df1b2910c6a2957137ff0623f6b777213fac4ee65f0e5b65109d26cc6a3e7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f4686aeac4fae0154d7f7f7ea803edcd7c9895c3b5c03a5df679420bbf5d9c1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 93B012853BC240FC324591086D02F77014CC1C0B113304B1FFC05CA291E8801CDC3031
                                                                                                                                                                                                                                              Function 002D9C54 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 002D9BE7
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 002C29AF
                                                                                                                                                                                                                                                • Part of subcall function 002C293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 002C29C0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1269201914-0
                                                                                                                                                                                                                                              • Opcode ID: 9f8e161c6d9efc28c2a692ba7761783d10b7f80fdc2547a417070a135f3b3a69
                                                                                                                                                                                                                                              • Instruction ID: 3a87cee088e979697a872d97f02c86fa89c038cf5eafed6cede381026df17933
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9f8e161c6d9efc28c2a692ba7761783d10b7f80fdc2547a417070a135f3b3a69
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EAB012853BC140FC314591086D02F37015CC1C0B113304E1FF805CA2D1E8801C987031
                                                                                                                                                                                                                                              Function 0028ECD0 Relevance: 1.3, APIs: 1, Instructions: 30stringCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: lstrlen
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1659193697-0
                                                                                                                                                                                                                                              • Opcode ID: fae5912a4645853405c73b4b755aa08d588df906774614216e2e7d0372cf5a64
                                                                                                                                                                                                                                              • Instruction ID: d0d3b4c88e9269c18bc1a9c8ccc5106aa25f0cf5b24210cd154c55d02ccbc279
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fae5912a4645853405c73b4b755aa08d588df906774614216e2e7d0372cf5a64
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 90E0E537200119ABDB019F89EC44D9AF76DFBD5371705403BF90487120D772AC25C7A0

                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                              Function 00290540 Relevance: 98.2, APIs: 29, Strings: 27, Instructions: 220libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?,1CE34B5F), ref: 00290571
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 002905B7
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,SetEntriesInAclW), ref: 002905DD
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetFileSecurityW), ref: 002905E9
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,SetFileSecurityW), ref: 002905F5
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00290601
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetExplicitEntriesFromAclW), ref: 0029060D
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,RegGetKeySecurity), ref: 0029061C
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,RegSetKeySecurity), ref: 00290628
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,InitializeSecurityDescriptor), ref: 00290634
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,SetSecurityDescriptorDacl), ref: 00290640
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetSecurityDescriptorDacl), ref: 0029064C
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,AllocateAndInitializeSid), ref: 00290658
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,FreeSid), ref: 00290664
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,OpenThreadToken), ref: 00290670
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 0029067C
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,InitializeAcl), ref: 00290688
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,InitializeSid), ref: 00290694
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetSidSubAuthority), ref: 002906A0
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,AddAccessAllowedAce), ref: 002906AC
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetSecurityInfo), ref: 002906B8
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,SetSecurityInfo), ref: 002906C4
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,QueryServiceStatusEx), ref: 002906D0
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetAce), ref: 002906DC
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,DeleteAce), ref: 002906E8
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,EqualSid), ref: 002906F4
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,GetAclInformation), ref: 00290700
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,SetSecurityDescriptorControl), ref: 0029070F
                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?), ref: 002907DE
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc$CriticalSection$EnterFreeLeaveLibrary
                                                                                                                                                                                                                                              • String ID: AddAccessAllowedAce$AllocateAndInitializeSid$DeleteAce$EqualSid$FreeSid$GetAce$GetAclInformation$GetExplicitEntriesFromAclW$GetFileSecurityW$GetSecurityDescriptorDacl$GetSecurityInfo$GetSidSubAuthority$GetTokenInformation$InitializeAcl$InitializeSecurityDescriptor$InitializeSid$LookupAccountSidW$OpenThreadToken$QueryServiceStatusEx$RegGetKeySecurity$RegSetKeySecurity$SetEntriesInAclW$SetFileSecurityW$SetSecurityDescriptorControl$SetSecurityDescriptorDacl$SetSecurityInfo$advapi32.dll
                                                                                                                                                                                                                                              • API String ID: 2701342527-838666417
                                                                                                                                                                                                                                              • Opcode ID: d296ee0c03b46b7884a604eda6c4eda70d6892e909b518d78ff00bc39012ac69
                                                                                                                                                                                                                                              • Instruction ID: 9a7bda8e211a0650372223962f0f24251233e2dddb99b3cdc1252e077cefbecf
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d296ee0c03b46b7884a604eda6c4eda70d6892e909b518d78ff00bc39012ac69
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 10813934950B2AFECF229FA1DD88BD5BFA1FF15325F000526E904669A0D7B5A468CFC1
                                                                                                                                                                                                                                              Function 002AF3C0 Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 463encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 002AF442
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 002AF488
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 002AF4C6
                                                                                                                                                                                                                                              • CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 002AF527
                                                                                                                                                                                                                                              • CertGetNameStringW.CRYPT32(00000000,00000005,00000000,00000000,00000000,00000000), ref: 002AF5AD
                                                                                                                                                                                                                                              • CertGetNameStringW.CRYPT32(?,00000005,00000000,00000000,00000000,?), ref: 002AF602
                                                                                                                                                                                                                                              • CertGetCertificateChain.CRYPT32(00000000,?,?,00000000,00000010,00000000,00000000,?), ref: 002AF89C
                                                                                                                                                                                                                                              • CertFreeCertificateChain.CRYPT32(00000000), ref: 002AF8B1
                                                                                                                                                                                                                                              • CertFreeCertificateChain.CRYPT32(00000000), ref: 002AF8CB
                                                                                                                                                                                                                                                • Part of subcall function 002AE760: CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 002AE877
                                                                                                                                                                                                                                              • CertVerifyCertificateChainPolicy.CRYPT32(00000003,00000000,0000000C,00000014), ref: 002AF906
                                                                                                                                                                                                                                              • CertFreeCertificateChain.CRYPT32(00000000), ref: 002AF942
                                                                                                                                                                                                                                              • CertFreeCRLContext.CRYPT32(?), ref: 002AFA73
                                                                                                                                                                                                                                              • CertFreeCRLContext.CRYPT32(00000000), ref: 002AFAA6
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Cert$Certificate$ChainFree$ContextCryptParam$NameString$FromPolicyPropertyStoreSubjectVerify
                                                                                                                                                                                                                                              • String ID: 4$Intel Corporation$McAfee, Inc.$McAfee, LLC$McAfee, LLC.$Yahoo! Inc.
                                                                                                                                                                                                                                              • API String ID: 2452394995-549729705
                                                                                                                                                                                                                                              • Opcode ID: 986ebe64b23d92a07848e45c3f84da0642ece8c4aaa852b3a9ea750e927ed6f5
                                                                                                                                                                                                                                              • Instruction ID: 15673952ccd58ce50b0c77044ca36e06bb8edc160480bad2d4577c5e7da247b9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 986ebe64b23d92a07848e45c3f84da0642ece8c4aaa852b3a9ea750e927ed6f5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A112D370D1022ADBDF719F60CE49BDAB7B8AF16704F0001E9E809A7291DB399E94CF50
                                                                                                                                                                                                                                              Function 002AEB60 Relevance: 27.5, APIs: 18, Instructions: 477encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CryptQueryObject.CRYPT32(00000001,0029BDCE,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002AEBD2
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AEBE4
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AEBF4
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AECEE
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AECFE
                                                                                                                                                                                                                                              • CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002AEDEE
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AEE0A
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AEE1C
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AEEB6
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AEEC2
                                                                                                                                                                                                                                                • Part of subcall function 002AF3C0: CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 002AF442
                                                                                                                                                                                                                                                • Part of subcall function 002AF3C0: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 002AF488
                                                                                                                                                                                                                                                • Part of subcall function 002AF3C0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 002AF4C6
                                                                                                                                                                                                                                                • Part of subcall function 002AF3C0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 002AF527
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AEF02
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AEF14
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AEFAE
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AEFBA
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AEFDA
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AEFEA
                                                                                                                                                                                                                                              • CryptMsgClose.CRYPT32(00000000), ref: 002AF0CB
                                                                                                                                                                                                                                              • CertCloseStore.CRYPT32(00000000,00000001), ref: 002AF0DB
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2648890560-0
                                                                                                                                                                                                                                              • Opcode ID: 0b1d8596f3c372b51d7ea20cd09bd23abb080adcbd5458b1775e018a0c732df3
                                                                                                                                                                                                                                              • Instruction ID: 54e7c06980da284ee54d2f96b0efd5aaf30a456274bea436d9884fd94624f496
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0b1d8596f3c372b51d7ea20cd09bd23abb080adcbd5458b1775e018a0c732df3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A028E71E102099FEF14DFA8CD89BEEBBB8AF09314F154519E901F7281DB74AA15CB60
                                                                                                                                                                                                                                              Function 002A2B30 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • LoadLibraryW.KERNEL32(?,1CE34B5F,00000000,?,00000000,?,002A3AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004,?), ref: 002A2B73
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,Dispatcher), ref: 002A2B98
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,Controller), ref: 002A2BA7
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,Release), ref: 002A2BC8
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 002A2C46
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 002A2CC3
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,002A3AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004), ref: 002A2CCB
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance, xrefs: 002A2CDF
                                                                                                                                                                                                                                              • Controller, xrefs: 002A2B9E
                                                                                                                                                                                                                                              • Failed to load library %s. Error 0x%08X, xrefs: 002A2CD5
                                                                                                                                                                                                                                              • Release, xrefs: 002A2BC2
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp, xrefs: 002A2CE4
                                                                                                                                                                                                                                              • Dispatcher, xrefs: 002A2B92
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressLibraryProc$Free$ErrorLastLoad
                                                                                                                                                                                                                                              • String ID: Controller$Dispatcher$Failed to load library %s. Error 0x%08X$NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance$Release$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp
                                                                                                                                                                                                                                              • API String ID: 2058215185-435243658
                                                                                                                                                                                                                                              • Opcode ID: 0aeb0948461875e79bffae698b86bdc5c77a03278e84de210663f742bb3ca9d8
                                                                                                                                                                                                                                              • Instruction ID: c8d4d69783b5912f2bca3568d92bbe2f0f389e6e71aa67570b7328cbf6cede4e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0aeb0948461875e79bffae698b86bdc5c77a03278e84de210663f742bb3ca9d8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5B4157B0910325DFD7018FA9D945B9EBBB8BF0D710F05816AE805AB291DBB58904CFA5
                                                                                                                                                                                                                                              Function 00276220 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 428encryptionthreadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?), ref: 00276268
                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 00276274
                                                                                                                                                                                                                                              • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?,?,?,?,?,?), ref: 002763BF
                                                                                                                                                                                                                                              • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 002763DF
                                                                                                                                                                                                                                              • CryptHashData.ADVAPI32(00000000,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 002763FC
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • al exception rule %x:%x res %s, xrefs: 0027632E
                                                                                                                                                                                                                                              • 3c224a00-5d51-11cf-b3ca-000000000001, xrefs: 0027671E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Crypt$CurrentHash$AcquireContextCreateDataProcessThread
                                                                                                                                                                                                                                              • String ID: 3c224a00-5d51-11cf-b3ca-000000000001$al exception rule %x:%x res %s
                                                                                                                                                                                                                                              • API String ID: 3004248768-911235813
                                                                                                                                                                                                                                              • Opcode ID: 7b4574e98498d2c79717bb38185ae7ae16d1fa51974477e9a75cbd2e830f1eda
                                                                                                                                                                                                                                              • Instruction ID: 908920727b5bb6c5c727d0c4e9de3dbc593655ac4d7557fea0516742ccd59137
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7b4574e98498d2c79717bb38185ae7ae16d1fa51974477e9a75cbd2e830f1eda
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 91F13A35B112299FCB299F14CC95BEDB7B9BF48710F184499E90AA7390CB70AE51CF90
                                                                                                                                                                                                                                              Function 002767B0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 150encryptionthreadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 002767F3
                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 002767FB
                                                                                                                                                                                                                                              • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0027687F
                                                                                                                                                                                                                                              • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0027689F
                                                                                                                                                                                                                                              • CryptHashData.ADVAPI32(00000000,?,00000000,00000000), ref: 002768BC
                                                                                                                                                                                                                                              • CryptGetHashParam.ADVAPI32(00000000,00000002,?,00000010,00000000), ref: 002768DE
                                                                                                                                                                                                                                              • CryptDestroyHash.ADVAPI32(00000000), ref: 002768EF
                                                                                                                                                                                                                                              • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00276902
                                                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 00276951
                                                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(?,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 00276980
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • al exception rule %x:%x res %s, xrefs: 00276824
                                                                                                                                                                                                                                              • Freeing access handle %p, xrefs: 002767D0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Crypt$Hash$ContextControlCurrentDevice$AcquireCreateDataDestroyParamProcessReleaseThread
                                                                                                                                                                                                                                              • String ID: Freeing access handle %p$al exception rule %x:%x res %s
                                                                                                                                                                                                                                              • API String ID: 581428007-3582322424
                                                                                                                                                                                                                                              • Opcode ID: 5763f103e3dad4a4ae5c713f2fd3d8bf021ce3c23e908dc4a219ddad3b14c1d6
                                                                                                                                                                                                                                              • Instruction ID: 8a15bfc9371c78b3fa054cbddf71f3258829c188906c690f1efc5e6dd4d44931
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5763f103e3dad4a4ae5c713f2fd3d8bf021ce3c23e908dc4a219ddad3b14c1d6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B519A71A10219ABDF258F61CC49FD677BCAB18710F148195FA18E61C1DBB0EE94CF61
                                                                                                                                                                                                                                              Function 002AF150 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 342encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 002AF442
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 002AF488
                                                                                                                                                                                                                                              • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 002AF4C6
                                                                                                                                                                                                                                              • CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 002AF527
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CryptParam$CertCertificateFromStoreSubject
                                                                                                                                                                                                                                              • String ID: 1.3.6.1.4.1.311.2.4.1
                                                                                                                                                                                                                                              • API String ID: 738114118-146536318
                                                                                                                                                                                                                                              • Opcode ID: 01acdbf235dd3f2af4dfab5e09c984a5d684e65939903c3ca922b3848b316dc9
                                                                                                                                                                                                                                              • Instruction ID: 8f5793b7420d2600d41e4ce02ab71d3d9f746a275fe86802cdef37b70913ea65
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 01acdbf235dd3f2af4dfab5e09c984a5d684e65939903c3ca922b3848b316dc9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64D17E71D102199FCB65DFA4C985BEEBBB5EF4A310F1041AAE819A7340DB349E54CF90
                                                                                                                                                                                                                                              Function 002FCFDB Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: _free.LIBCMT ref: 002F1D0B
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: _free.LIBCMT ref: 002F1D41
                                                                                                                                                                                                                                              • GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 002FD0E7
                                                                                                                                                                                                                                              • IsValidCodePage.KERNEL32(00000000), ref: 002FD130
                                                                                                                                                                                                                                              • IsValidLocale.KERNEL32(?,00000001), ref: 002FD13F
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 002FD187
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 002FD1A6
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
                                                                                                                                                                                                                                              • String ID: (33
                                                                                                                                                                                                                                              • API String ID: 949163717-2191837804
                                                                                                                                                                                                                                              • Opcode ID: 78c00d5947e9fd13c0d34089f623a0b128a33b8dc7fdf9974128644834de2082
                                                                                                                                                                                                                                              • Instruction ID: 4f63cd1e0bd8bf3aae5d2b217101f4ed1aa39f88d5d7ae0a31a1e3eaa8e28484
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 78c00d5947e9fd13c0d34089f623a0b128a33b8dc7fdf9974128644834de2082
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D51707192020EABDB11DFA4CC41ABBF7B9FF09780F144439EA15EB150EBB19915CB61
                                                                                                                                                                                                                                              Function 002FCE06 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,2000000B,002FD124,00000002,00000000,?,?,?,002FD124,?,00000000), ref: 002FCE9F
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,20001004,002FD124,00000002,00000000,?,?,?,002FD124,?,00000000), ref: 002FCEC8
                                                                                                                                                                                                                                              • GetACP.KERNEL32(?,?,002FD124,?,00000000), ref: 002FCEDD
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InfoLocale
                                                                                                                                                                                                                                              • String ID: ACP$OCP
                                                                                                                                                                                                                                              • API String ID: 2299586839-711371036
                                                                                                                                                                                                                                              • Opcode ID: 9d515df69adb065e91592065d08da29a881072d5552c894b0f032e6c05afef22
                                                                                                                                                                                                                                              • Instruction ID: a52cd9945cd9762bb157c8e78810125e6300dd94533070ed0ddc5306bce9f92f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9d515df69adb065e91592065d08da29a881072d5552c894b0f032e6c05afef22
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB21A771A2410EAAD7358F14CA00AB7F2A6AB64BD4B768434EA06D7214E732DD60C390
                                                                                                                                                                                                                                              Function 00307BC0 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00307BE9
                                                                                                                                                                                                                                              • GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 00307BFD
                                                                                                                                                                                                                                              • VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00307C4D
                                                                                                                                                                                                                                              • VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00307C62
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Virtual$AllocInfoProtectQuerySystem
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3562403962-0
                                                                                                                                                                                                                                              • Opcode ID: 9243bd67c1e078152abb8279ca6558a3ab9a9528a416b8a7a1b59dbef0d4d2ce
                                                                                                                                                                                                                                              • Instruction ID: 922883c36656c68a1ab3532ae62c99985f53ca29e6d26eb3f36a8376ce87009b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9243bd67c1e078152abb8279ca6558a3ab9a9528a416b8a7a1b59dbef0d4d2ce
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A2171B2E0021DABDB21EBA4DC95EEFB7BCEB48750F050525E915E7180EA70E901CB90
                                                                                                                                                                                                                                              Function 002D93F2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002D93FE
                                                                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32 ref: 002D94CA
                                                                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 002D94EA
                                                                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 002D94F4
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 254469556-0
                                                                                                                                                                                                                                              • Opcode ID: c5b68fed216765596f5567bf3999b9f2a93d30617fdb7697d8a38c1acf996f3f
                                                                                                                                                                                                                                              • Instruction ID: b50ec8a6db7ca38a315141fc7798162495621ca5b23b23c6b392af944d969677
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c5b68fed216765596f5567bf3999b9f2a93d30617fdb7697d8a38c1acf996f3f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 58312775D1121D9BDB21EFA4D989BCDBBB8AF08300F5041AAE40DAB250EB719E858F05
                                                                                                                                                                                                                                              Function 002FCA80 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: _free.LIBCMT ref: 002F1D0B
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: _free.LIBCMT ref: 002F1D41
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FCAD4
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FCB1E
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FCBE4
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InfoLocale$ErrorLast_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3140898709-0
                                                                                                                                                                                                                                              • Opcode ID: 7186484446d625515a2b4d61cfc6b444d0b8a2cd65c5d82b91fe7a014dc23afb
                                                                                                                                                                                                                                              • Instruction ID: e99922bdbac25e2437d7f902531f9a4cf3b6675b14618f2f1227c804f0392876
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7186484446d625515a2b4d61cfc6b444d0b8a2cd65c5d82b91fe7a014dc23afb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1861A47152021F9FDB289F24CE82BB6B7A8EF14784F24407BEE05C6285E735D9A0DB50
                                                                                                                                                                                                                                              Function 002DD453 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,?,?,003580CC), ref: 002DD54B
                                                                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,003580CC), ref: 002DD555
                                                                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,003580CC), ref: 002DD562
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3906539128-0
                                                                                                                                                                                                                                              • Opcode ID: 4086c6f1b1bcaf4b7e9677eb574102b28e09d7efb2d3b9cd021ed7b63fff3a08
                                                                                                                                                                                                                                              • Instruction ID: b8924d058105cb79a91336d453b684ce0466aba55c634d7b911620d9c0969c18
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4086c6f1b1bcaf4b7e9677eb574102b28e09d7efb2d3b9cd021ed7b63fff3a08
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD31C97491121DABCB61DF24D889BCDBBB8BF18310F5041EAE40CA7250EB709F958F45
                                                                                                                                                                                                                                              Function 002F70B4 Relevance: 3.1, APIs: 2, Instructions: 55COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,002E5A30,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,?,00000003,?,?,?,00000000,00000480), ref: 002F703D
                                                                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(?,?,002E5A30,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,?,00000003,?,?,?,00000000,00000480,?), ref: 002F7054
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DebugDebuggerOutputPresentString
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4086329628-0
                                                                                                                                                                                                                                              • Opcode ID: 0c621d38ba884aedfabd116478a1ad05c43c12aef9be29b1e2dc060d4e7bf42f
                                                                                                                                                                                                                                              • Instruction ID: 9993a36295ffe268cb480c1563a67f0d7b5de75701513d59631892c8f0e56e4e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c621d38ba884aedfabd116478a1ad05c43c12aef9be29b1e2dc060d4e7bf42f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FE01D43117812E66AA203E519C15F7BB74D9F053E1F244439FF04C6141DE62C83199B2
                                                                                                                                                                                                                                              Function 002D9215 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 002D922B
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FeaturePresentProcessor
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2325560087-0
                                                                                                                                                                                                                                              • Opcode ID: 57916f025df3ae8e0fa38930652a81b52652e2a2a99bfe06e7f2ec3ea83d5af2
                                                                                                                                                                                                                                              • Instruction ID: 535dc37c63a816fc929509f0214802a8e876a813e7527bb2eb25f25a1ae18592
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 57916f025df3ae8e0fa38930652a81b52652e2a2a99bfe06e7f2ec3ea83d5af2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A8517171E202059FEB15CF58E9857AAB7F4FB48311F14856BE405EB3A0D374AD50CB50
                                                                                                                                                                                                                                              Function 002FCCE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: _free.LIBCMT ref: 002F1D0B
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: _free.LIBCMT ref: 002F1D41
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FCD34
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast_free$InfoLocale
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2003897158-0
                                                                                                                                                                                                                                              • Opcode ID: bb13cf6ce399d88f08b0076c12f0ca4a7374c3d93de44bd0b29444be497b0242
                                                                                                                                                                                                                                              • Instruction ID: 16a5a1a1ed42f05ac433888e8d0ca0bbea1aa01dbb5c09a3b5e0d50b1c44c04e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bb13cf6ce399d88f08b0076c12f0ca4a7374c3d93de44bd0b29444be497b0242
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2C21B67252020FABDB189E25DD52ABEB7ACEF44750F24007AFE05D6141EB74DD248A50
                                                                                                                                                                                                                                              Function 002FC952 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                              • EnumSystemLocalesW.KERNEL32(002FCA80,00000001,00000000,?,-00000050,?,002FD0BB,00000000,?,?,?,00000055,?), ref: 002FC9C4
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2417226690-0
                                                                                                                                                                                                                                              • Opcode ID: 8b3362924ed7d420ece9f742b5e503530fb16d3f6a6bcde2423884b1d0eaedbe
                                                                                                                                                                                                                                              • Instruction ID: 84013dda93e4f6161e0900899fba883f92c76885ce4667978c39025bb6d5752c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8b3362924ed7d420ece9f742b5e503530fb16d3f6a6bcde2423884b1d0eaedbe
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8811293621030D9FDB189F39C9915BAF791FF84398B24443DEA4787640D371B912CB40
                                                                                                                                                                                                                                              Function 002FCF0C Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,002FCC9C,00000000,00000000,?), ref: 002FCF38
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$InfoLocale
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3736152602-0
                                                                                                                                                                                                                                              • Opcode ID: fb8f50081c80dcc10fc6e6203973cd6dbcd34b1586033be5122f704553ba9a66
                                                                                                                                                                                                                                              • Instruction ID: 2af5853f35357b2082d2042bdf771699f2e91e0449bac50960e30ce1bd57c28f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fb8f50081c80dcc10fc6e6203973cd6dbcd34b1586033be5122f704553ba9a66
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CEF0F93252011EBBDB245F24C905BBAFB59EF40794F254536EE15A3580DA70FE51C990
                                                                                                                                                                                                                                              Function 002FC9ED Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                              • EnumSystemLocalesW.KERNEL32(002FCCE0,00000001,?,?,-00000050,?,002FD07F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 002FCA37
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2417226690-0
                                                                                                                                                                                                                                              • Opcode ID: b8ae8402003d6cdcebc1bb315a19fd7b76745ba460cc620f1eee792ad53365c8
                                                                                                                                                                                                                                              • Instruction ID: 91aee5ba77cdecf51f930c2272ffe9901c0e7d5914ddb52de97ec7204cf2abea
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b8ae8402003d6cdcebc1bb315a19fd7b76745ba460cc620f1eee792ad53365c8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 11F0463221030C5FCB149F39DD81ABAFB94EF813A8F25803EFA058B690C271AC11CA50
                                                                                                                                                                                                                                              Function 002F3F6D Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002ECD41: EnterCriticalSection.KERNEL32(?,?,002EF653,00000000,0034C338,0000000C,002EF61A,?,?,002F3400,?,?,002F1E4B,00000001,00000364,00000006), ref: 002ECD50
                                                                                                                                                                                                                                              • EnumSystemLocalesW.KERNEL32(Function_000A3F60,00000001,0034C4B8,0000000C,002F447F,?), ref: 002F3FA5
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1272433827-0
                                                                                                                                                                                                                                              • Opcode ID: 4817fcbefca1965a5c576f13b5853331a35573f0b09d355268e78a2e6ebd5e6a
                                                                                                                                                                                                                                              • Instruction ID: e22ddfa81c5d8249d06951f18a86c15e835dde47ed0bdfb6a6ef9ca85ede63a3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4817fcbefca1965a5c576f13b5853331a35573f0b09d355268e78a2e6ebd5e6a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88F04932A50204EFD702DF98E842BADBBF4FB09721F10822AF9109B2A0DB755910CF50
                                                                                                                                                                                                                                              Function 002FC907 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                              • EnumSystemLocalesW.KERNEL32(002FC860,00000001,?,?,?,002FD0DD,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 002FC93E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2417226690-0
                                                                                                                                                                                                                                              • Opcode ID: d78f16e0386f993406d0af38a59671bd829a83ebd01e4b6e4716d83c71249d91
                                                                                                                                                                                                                                              • Instruction ID: 2da8f1b7accc96c9d4b2bf563f1f2198d95f0cd3dd0e3c4df7172d95c16364a9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d78f16e0386f993406d0af38a59671bd829a83ebd01e4b6e4716d83c71249d91
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3F05C3630020D57CB069F75DD15676FF54EFC1790F164069FF058B240C2719952CB50
                                                                                                                                                                                                                                              Function 002D7E28 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,002D5D32,00000000,?,00000004,002D4946,?,00000004,002D4D77,00000000,00000000), ref: 002D7E40
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InfoLocale
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2299586839-0
                                                                                                                                                                                                                                              • Opcode ID: 9b86c75f29d336256c0cc1acd1f446c9969e69459bc35e65db558d38f8200792
                                                                                                                                                                                                                                              • Instruction ID: 69fe3b646398ba478279f8a5f68afccd1268d281478dce2f9f055bdfc66fb976
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b86c75f29d336256c0cc1acd1f446c9969e69459bc35e65db558d38f8200792
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27E0D8326B4145F5EB069FB89E0FFBE77ACD701709F104692A502E42E2E6A4CF20A191
                                                                                                                                                                                                                                              Function 002F45DA Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,002F0C61,?,20001004,00000000,00000002,?,?,002F024C), ref: 002F460E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InfoLocale
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2299586839-0
                                                                                                                                                                                                                                              • Opcode ID: 1478fd1af99ede39dfaea5220704e618108fec964884cb00cd7f2dd2903f4a65
                                                                                                                                                                                                                                              • Instruction ID: e09170e0ea818f6b142810fc31a4b964dc91d6961b8c4336fa70684601ab1070
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1478fd1af99ede39dfaea5220704e618108fec964884cb00cd7f2dd2903f4a65
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99E01A3151012DBBCB123F60EC04EAEBA19AF45BA1F054420FE1566161CBB29970AAD8
                                                                                                                                                                                                                                              Function 002AE610 Relevance: 1.5, APIs: 1, Instructions: 6encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCrypt
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1563465135-0
                                                                                                                                                                                                                                              • Opcode ID: 2b1a43b9fe2be252ab8b3b40bee10ffdb848b632a785a322cfd54ca9e0e3a2a2
                                                                                                                                                                                                                                              • Instruction ID: a313e36db632c4704c9fbf10b09d1d86aeff5941c39de37ce4d49295b293252b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b1a43b9fe2be252ab8b3b40bee10ffdb848b632a785a322cfd54ca9e0e3a2a2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 20B01270A00201879F418F32890C901325C5A0170235508446000C3060DA20C800C914
                                                                                                                                                                                                                                              Function 002D9586 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(Function_000895A0,002D8A95), ref: 002D958B
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3192549508-0
                                                                                                                                                                                                                                              • Opcode ID: b897f9f54adb7f82dc9b3e5b004284c4ca23a8a13fabc572e12304baf06fc126
                                                                                                                                                                                                                                              • Instruction ID: 704d5f7e0e7338846d632036034fd30fe1472fb1171db459f4c0c74570594f24
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b897f9f54adb7f82dc9b3e5b004284c4ca23a8a13fabc572e12304baf06fc126
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                              Function 0026463F Relevance: 1.3, APIs: 1, Instructions: 58memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002D88FA: EnterCriticalSection.KERNEL32(0035742C,?,?,?,0027402B,0035827C,1CE34B5F,?,00271171,?), ref: 002D8905
                                                                                                                                                                                                                                                • Part of subcall function 002D88FA: LeaveCriticalSection.KERNEL32(0035742C,?,?,?,0027402B,0035827C,1CE34B5F,?,00271171,?), ref: 002D8942
                                                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(?,?,?,0028C2E1,?,?,?,1CE34B5F,?,00000000), ref: 00264676
                                                                                                                                                                                                                                                • Part of subcall function 002D88B0: EnterCriticalSection.KERNEL32(0035742C,?,?,00274086,0035827C,003168E0,?), ref: 002D88BA
                                                                                                                                                                                                                                                • Part of subcall function 002D88B0: LeaveCriticalSection.KERNEL32(0035742C,?,?,00274086,0035827C,003168E0,?), ref: 002D88ED
                                                                                                                                                                                                                                                • Part of subcall function 002D88B0: RtlWakeAllConditionVariable.NTDLL ref: 002D8964
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 325507722-0
                                                                                                                                                                                                                                              • Opcode ID: 51d727f36afb917ad5227b8c09df505105742e7a666d3b3b5b27c66efe19f423
                                                                                                                                                                                                                                              • Instruction ID: c0844ca7346dd0681ed2ec1414de0238ee596f549d4d4cf1120c81078fe643b8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 51d727f36afb917ad5227b8c09df505105742e7a666d3b3b5b27c66efe19f423
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1118B75524705FFD352AB28FC06B8637A8A744336F18052AEA08E72F1DF74688D8F24
                                                                                                                                                                                                                                              Function 002F4619 Relevance: 1.3, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • GetSystemTimePreciseAsFileTime, xrefs: 002F4629
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                                                                                                                                              • API String ID: 0-595813830
                                                                                                                                                                                                                                              • Opcode ID: 1552244731b2dbe38aee21353441fba15c74a6dfaaa5596bb92f78af1229dd9a
                                                                                                                                                                                                                                              • Instruction ID: 2c2ea2c5fed080ae574c37b61b46aa91516966f020a59b60bf50156ccc26e56d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1552244731b2dbe38aee21353441fba15c74a6dfaaa5596bb92f78af1229dd9a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D5E0C23268062873822236D46C06EFBBF18CB50BB1F040032FF0466241C9A2486186D9
                                                                                                                                                                                                                                              Function 002F7D23 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 4d75a9aa6775f7180b891de9cab6676b8f573877bff5f7f57c61d6fe8beece2a
                                                                                                                                                                                                                                              • Instruction ID: 8c43e9ead1262551cfb09d0b51d1b1d13a757c75a8345e2c35e328cdbc18aa88
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d75a9aa6775f7180b891de9cab6676b8f573877bff5f7f57c61d6fe8beece2a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64F0C232668628ABC626DA5CC918FB8B29CEB45B80F510165E301E73A0C7B0DE10CBC0
                                                                                                                                                                                                                                              Function 002F7C6A Relevance: .0, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 546f69a1d475f6816651934124e255e6be667db73328638e1097ae9966437b2d
                                                                                                                                                                                                                                              • Instruction ID: 151f41f7d0812f8b0d6f56489b22912943bea3f6729006546d73aa31917f33c4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 546f69a1d475f6816651934124e255e6be667db73328638e1097ae9966437b2d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7AF06531625328EFDB26DB4CD815B69B3ACEB45BA2F1240A7F601EB190D6B0DD50CBD0
                                                                                                                                                                                                                                              Function 002F7CAE Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 315b3ba4c4b8d120815677387e72d10c1e54d6c52b976cced81612a3e6a269b1
                                                                                                                                                                                                                                              • Instruction ID: 1d9839e3a38a6abf1bdb5463a479ee6575f33e354359b8208b5db06f84ce48a0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 315b3ba4c4b8d120815677387e72d10c1e54d6c52b976cced81612a3e6a269b1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35F03032A24228AFCB26DB4CD805B59B3ACEB45B95F1100A7F502E7250CAB0DE54CBC0
                                                                                                                                                                                                                                              Function 002F7CF2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: e987def8769bcac00432ddd4e9e7791ba2548d1561dedc4a3590fd0733c09369
                                                                                                                                                                                                                                              • Instruction ID: 8a39ac1af1be33338b3702f8831cf6090a73789f9fbe8d81d5de58d2d86c16d3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e987def8769bcac00432ddd4e9e7791ba2548d1561dedc4a3590fd0733c09369
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88E08C3292522CEBCB14DB9CC9449AAF3ECEB49B80B6104A6B601D3110C2B0DE00CBD0
                                                                                                                                                                                                                                              Function 002C6AB0 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 002C6AB6
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 002C6AC4
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 002C6AD5
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 002C6AE6
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 002C6AF7
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 002C6B08
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 002C6B19
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 002C6B2A
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 002C6B3B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 002C6B4C
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 002C6B5D
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 002C6B6E
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 002C6B7F
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 002C6B90
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 002C6BA1
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 002C6BB2
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 002C6BC3
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 002C6BD4
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 002C6BE5
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 002C6BF6
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 002C6C07
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 002C6C18
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 002C6C29
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 002C6C3A
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 002C6C4B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 002C6C5C
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 002C6C6D
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 002C6C7E
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 002C6C8F
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 002C6CA0
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 002C6CB1
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 002C6CC2
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 002C6CD3
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 002C6CE4
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 002C6CF5
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 002C6D06
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 002C6D17
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 002C6D28
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 002C6D39
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 002C6D4A
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 002C6D5B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                              • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                                                                                                                                                                                                              • API String ID: 667068680-295688737
                                                                                                                                                                                                                                              • Opcode ID: 34a12089f29c4e119ba3160cfd1630dbbdbd1d226615814dc7972b63f18cbbac
                                                                                                                                                                                                                                              • Instruction ID: ace481813c9ec018e30a8c85c43fba6cdbbb742a3d0e62e548403ab114ddb1db
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 34a12089f29c4e119ba3160cfd1630dbbdbd1d226615814dc7972b63f18cbbac
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FE61FC71996330ABD743AFB5BC4E9D63AACBA1EB02B048DAAF905D3171D6F54040CB91
                                                                                                                                                                                                                                              Function 002CE2B1 Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 449COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002CE2B8
                                                                                                                                                                                                                                              • ctype.LIBCPMT ref: 002CE2FF
                                                                                                                                                                                                                                                • Part of subcall function 00263055: __Getctype.LIBCPMT ref: 00263064
                                                                                                                                                                                                                                                • Part of subcall function 002C7FAF: __EH_prolog3.LIBCMT ref: 002C7FB6
                                                                                                                                                                                                                                                • Part of subcall function 002C7FAF: std::_Lockit::_Lockit.LIBCPMT ref: 002C7FC0
                                                                                                                                                                                                                                                • Part of subcall function 002C7FAF: std::_Lockit::~_Lockit.LIBCPMT ref: 002C8031
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE30D
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE324
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE36B
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE39E
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE3F0
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE405
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE424
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE443
                                                                                                                                                                                                                                              • collate.LIBCPMT ref: 002CE44D
                                                                                                                                                                                                                                              • __Getcoll.LIBCPMT ref: 002CE48F
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE4BA
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE4FB
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE510
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE559
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE58C
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE5E7
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE643
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE696
                                                                                                                                                                                                                                                • Part of subcall function 002C8203: __EH_prolog3.LIBCMT ref: 002C820A
                                                                                                                                                                                                                                                • Part of subcall function 002C8203: std::_Lockit::_Lockit.LIBCPMT ref: 002C8214
                                                                                                                                                                                                                                                • Part of subcall function 002C8203: std::_Lockit::~_Lockit.LIBCPMT ref: 002C8285
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE6B5
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE707
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE74C
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE761
                                                                                                                                                                                                                                                • Part of subcall function 002C87D5: __EH_prolog3.LIBCMT ref: 002C87DC
                                                                                                                                                                                                                                                • Part of subcall function 002C87D5: std::_Lockit::_Lockit.LIBCPMT ref: 002C87E6
                                                                                                                                                                                                                                                • Part of subcall function 002C87D5: std::_Lockit::~_Lockit.LIBCPMT ref: 002C8857
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE780
                                                                                                                                                                                                                                                • Part of subcall function 002C7C31: __EH_prolog3.LIBCMT ref: 002C7C38
                                                                                                                                                                                                                                                • Part of subcall function 002C7C31: std::_Lockit::_Lockit.LIBCPMT ref: 002C7C42
                                                                                                                                                                                                                                                • Part of subcall function 002C7C31: std::_Lockit::~_Lockit.LIBCPMT ref: 002C7CB3
                                                                                                                                                                                                                                              • codecvt.LIBCPMT ref: 002CE7B5
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE7BF
                                                                                                                                                                                                                                                • Part of subcall function 002C86AB: __EH_prolog3.LIBCMT ref: 002C86B2
                                                                                                                                                                                                                                                • Part of subcall function 002C86AB: std::_Lockit::_Lockit.LIBCPMT ref: 002C86BC
                                                                                                                                                                                                                                                • Part of subcall function 002C86AB: std::_Lockit::~_Lockit.LIBCPMT ref: 002C872D
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE677
                                                                                                                                                                                                                                                • Part of subcall function 002C5688: Concurrency::cancel_current_task.LIBCPMT ref: 002C5748
                                                                                                                                                                                                                                                • Part of subcall function 002C5688: __EH_prolog3.LIBCMT ref: 002C5755
                                                                                                                                                                                                                                                • Part of subcall function 002C5688: std::locale::_Locimp::_Makeloc.LIBCPMT ref: 002C5781
                                                                                                                                                                                                                                                • Part of subcall function 002C5688: std::_Locinfo::~_Locinfo.LIBCPMT ref: 002C578C
                                                                                                                                                                                                                                                • Part of subcall function 002C8298: __EH_prolog3.LIBCMT ref: 002C829F
                                                                                                                                                                                                                                                • Part of subcall function 002C8298: std::_Lockit::_Lockit.LIBCPMT ref: 002C82A9
                                                                                                                                                                                                                                                • Part of subcall function 002C8298: std::_Lockit::~_Lockit.LIBCPMT ref: 002C831A
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE658
                                                                                                                                                                                                                                                • Part of subcall function 002C5688: __EH_prolog3.LIBCMT ref: 002C568F
                                                                                                                                                                                                                                                • Part of subcall function 002C5688: std::_Lockit::_Lockit.LIBCPMT ref: 002C5699
                                                                                                                                                                                                                                                • Part of subcall function 002C5688: std::_Lockit::~_Lockit.LIBCPMT ref: 002C573D
                                                                                                                                                                                                                                                • Part of subcall function 002C80D9: __EH_prolog3.LIBCMT ref: 002C80E0
                                                                                                                                                                                                                                                • Part of subcall function 002C80D9: std::_Lockit::_Lockit.LIBCPMT ref: 002C80EA
                                                                                                                                                                                                                                                • Part of subcall function 002C80D9: std::_Lockit::~_Lockit.LIBCPMT ref: 002C815B
                                                                                                                                                                                                                                              • numpunct.LIBCPMT ref: 002CE6F7
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE4A3
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002CE7D4
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Locimp::_std::locale::_$AddfacLocimp_$std::_$Lockit$H_prolog3$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypeLocinfoLocinfo::~_Makeloccodecvtcollatectypenumpunct
                                                                                                                                                                                                                                              • String ID: @s5$Ds5$Ds5$Hs5$Hs5$Ls5$Ps5$Ts5$Xs5$Xs5$\s5$\s5$`s5$`s5$ds5$hs5$hs5
                                                                                                                                                                                                                                              • API String ID: 3784148211-4019161659
                                                                                                                                                                                                                                              • Opcode ID: ce7bf45b0206615f6b62004cb5cc063fb694817b90d44917fc8d9b09f39932a6
                                                                                                                                                                                                                                              • Instruction ID: 21e6492619e06241bd422ad490e9c4cfdc3d0a3ca368845c1bd193ee34253289
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ce7bf45b0206615f6b62004cb5cc063fb694817b90d44917fc8d9b09f39932a6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EFE1E574C21626AEDF216F608846FBF7AA8DF01354F25462DF80467381DB748D649FE2
                                                                                                                                                                                                                                              Function 002D5D66 Relevance: 30.3, APIs: 20, Instructions: 287COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D5D6D
                                                                                                                                                                                                                                              • collate.LIBCPMT ref: 002D5D76
                                                                                                                                                                                                                                                • Part of subcall function 002D4A42: __EH_prolog3_GS.LIBCMT ref: 002D4A49
                                                                                                                                                                                                                                                • Part of subcall function 002D4A42: __Getcoll.LIBCPMT ref: 002D4AAD
                                                                                                                                                                                                                                                • Part of subcall function 002D4A42: std::_Locinfo::~_Locinfo.LIBCPMT ref: 002D4AC9
                                                                                                                                                                                                                                              • __Getcoll.LIBCPMT ref: 002D5DBC
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5DD0
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5DE5
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5E23
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5E36
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5E7C
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5EB0
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5F6B
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5F7E
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5F9B
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5FB8
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5FD5
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D5F0D
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • numpunct.LIBCPMT ref: 002D6014
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D6024
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D6068
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D607B
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002D6098
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddfacLocimp::_Locimp_std::locale::_$std::_$GetcollLockit$H_prolog3H_prolog3_LocinfoLocinfo::~_Lockit::_Lockit::~_collatenumpunct
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2009638416-0
                                                                                                                                                                                                                                              • Opcode ID: d609836a88c9ab911a9cbaf6e7badb59eb638167b53d2b94e97bc07a67793a65
                                                                                                                                                                                                                                              • Instruction ID: 9506aed4098a5c7424391a3935daba6b71ca0d96c1f909a87261bd76daca701a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d609836a88c9ab911a9cbaf6e7badb59eb638167b53d2b94e97bc07a67793a65
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8391D8B5D25A21AFD7217B648C09B7F7AA8DF05764F20452EF804A7341DBB48D205FE2
                                                                                                                                                                                                                                              Function 002B0780 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 250COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Unable to substitute DeleteFile attribute, xrefs: 002B08BC
                                                                                                                                                                                                                                              • Unable to verify signature for file: %s, xrefs: 002B0956
                                                                                                                                                                                                                                              • Failed to delete src cab (%d), xrefs: 002B0A0D
                                                                                                                                                                                                                                              • Failed to extract cab (%s), xrefs: 002B09D2
                                                                                                                                                                                                                                              • DeleteFile, xrefs: 002B086B
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp, xrefs: 002B08E5, 002B0962, 002B09A7, 002B09DE, 002B0A19, 002B0A49
                                                                                                                                                                                                                                              • invalid substitutor, xrefs: 002B07C5
                                                                                                                                                                                                                                              • Unable to create destination directory (%d), xrefs: 002B099B
                                                                                                                                                                                                                                              • DestDir, xrefs: 002B0813
                                                                                                                                                                                                                                              • NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute, xrefs: 002B08E0, 002B0A44
                                                                                                                                                                                                                                              • Source, xrefs: 002B07D1
                                                                                                                                                                                                                                              • NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand, xrefs: 002B095D, 002B09A2, 002B09D9, 002B0A14
                                                                                                                                                                                                                                              • Failed to parse DeleteFile as a boolean - default to false, xrefs: 002B08D9
                                                                                                                                                                                                                                              • Unable to substitute variables for the EXTRACT_CAB_LOCAL command, xrefs: 002B0A31
                                                                                                                                                                                                                                              • Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command, xrefs: 002B0A3D, 002B0A42
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: DeleteFile$DestDir$Failed to delete src cab (%d)$Failed to extract cab (%s)$Failed to parse DeleteFile as a boolean - default to false$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand$Source$Unable to create destination directory (%d)$Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command$Unable to substitute DeleteFile attribute$Unable to substitute variables for the EXTRACT_CAB_LOCAL command$Unable to verify signature for file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp$invalid substitutor
                                                                                                                                                                                                                                              • API String ID: 0-2605792675
                                                                                                                                                                                                                                              • Opcode ID: bced504b5b0475efd57119ee1e43b0115726600d6f8b2b1951ba418c0d63dc3d
                                                                                                                                                                                                                                              • Instruction ID: 74b7bb268678312498ee1ee3da2ca46023d5899fbaadac3d9db5203438958d52
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bced504b5b0475efd57119ee1e43b0115726600d6f8b2b1951ba418c0d63dc3d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6C910370A60305ABDF12DF90EC92BEFB7B9AF15B40F040419F901672C2DB75A964CBA1
                                                                                                                                                                                                                                              Function 0027A118 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 0027DE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027DF0C
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 0027A143
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027A1AA
                                                                                                                                                                                                                                                • Part of subcall function 0027E0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E161
                                                                                                                                                                                                                                              • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0027A1C1
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0027A1DD
                                                                                                                                                                                                                                              • CreateSemaphoreW.KERNEL32(00000000,00000000,000003E8,00000000), ref: 0027A24C
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0027A268
                                                                                                                                                                                                                                              • ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,00000000), ref: 0027A410
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001), ref: 0027A46F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$CloseCreateHandleSemaphore$ErrorEventLastMtx_unlockRelease
                                                                                                                                                                                                                                              • String ID: E$Failed to create event semaphore$Failed to create stop event$Failed to initialize event sender$Failed to release semaphore. Error: $V
                                                                                                                                                                                                                                              • API String ID: 1380281556-3274429967
                                                                                                                                                                                                                                              • Opcode ID: b5a98c7785bdbb99c198404df8dff8577b5f73eb88c2282b8461e2e4a5bafbf0
                                                                                                                                                                                                                                              • Instruction ID: f01ece6a7acc0e08432eb1f8edd8970f045f6493867062f3ab599fc68f67fa14
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b5a98c7785bdbb99c198404df8dff8577b5f73eb88c2282b8461e2e4a5bafbf0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 00B1E774A20209DBDB14EF60CC56BEDF7B9FF44314F108269E80967281EB716AA5CF91
                                                                                                                                                                                                                                              Function 002B0FA0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 141filelibraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,1CE34B5F,000000FF,00000000,00000000,0030DF30,000000FF), ref: 002B0FE8
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 002B0FF8
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(000000FF,00000001,00000001,00000000,00000003,00000080,00000000,1CE34B5F,000000FF,00000000,00000000,0030DF30,000000FF), ref: 002B1037
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002B1058
                                                                                                                                                                                                                                              • GetFileSize.KERNEL32(?,?), ref: 002B1088
                                                                                                                                                                                                                                              • CreateFileMappingW.KERNEL32(?,00000000,00000002,?,00000000,00000000), ref: 002B109C
                                                                                                                                                                                                                                              • MapViewOfFileEx.KERNEL32(00000000,00000004,00000000,00000000,?,00000000), ref: 002B10D9
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 002B10F0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Failed to map file to memory, xrefs: 002B1101
                                                                                                                                                                                                                                              • kernel32.dll, xrefs: 002B0FE3
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h, xrefs: 002B106B, 002B110D
                                                                                                                                                                                                                                              • Failed to open the file: %d, xrefs: 002B105F
                                                                                                                                                                                                                                              • CreateFileTransactedW, xrefs: 002B0FF2
                                                                                                                                                                                                                                              • NWebAdvisor::CFileMemMap::Init, xrefs: 002B1066, 002B1108
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$CreateHandle$AddressCloseErrorLastMappingModuleProcSizeView
                                                                                                                                                                                                                                              • String ID: CreateFileTransactedW$Failed to map file to memory$Failed to open the file: %d$NWebAdvisor::CFileMemMap::Init$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h$kernel32.dll
                                                                                                                                                                                                                                              • API String ID: 2423579280-2843467768
                                                                                                                                                                                                                                              • Opcode ID: 74e74c5173e6d071ae84b65136bb8c9a8f9fbaa9212fb2213751b899e3a7a016
                                                                                                                                                                                                                                              • Instruction ID: d46585e99f6d149206391c65868278b2dca1dbf904e72800ad7deb6efff021eb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 74e74c5173e6d071ae84b65136bb8c9a8f9fbaa9212fb2213751b899e3a7a016
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D841F770650302BBEB219F64DC56FEAB7A8BB08B50F504615FE15E72C0D7B1A960CB94
                                                                                                                                                                                                                                              Function 0027E843 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 319COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027E8A8
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID: Authorization: $Failed to create access token$HTTP receive response failed for Azure: $HTTP send request failed for Azure: $HTTP status error for Azure: $`ato$`3
                                                                                                                                                                                                                                              • API String ID: 539357862-2804663529
                                                                                                                                                                                                                                              • Opcode ID: 9a23c84a7f52dad140235f2557a9d3d9e4d7f2bc6415442f4b8e8da18b2a53a4
                                                                                                                                                                                                                                              • Instruction ID: aec6ed5fe3693de1a5beafdd055cb20182db22edb46553c1fe6963b9151db053
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a23c84a7f52dad140235f2557a9d3d9e4d7f2bc6415442f4b8e8da18b2a53a4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 59D18F70920219DBDF25DB60CD45BEDB3B8AF55304F5085D8E509A7281DB70ABD8CFA1
                                                                                                                                                                                                                                              Function 002B2FD0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 177registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,?,00000000,00000028,00000028,00000000,00000000,Name,00000004,00000000,00000000,Key,00000003,1CE34B5F), ref: 002B30F1
                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(00000008), ref: 002B317C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Cannnot delete registry value. Key or value not found. Key: %s Value: %s, xrefs: 002B3157
                                                                                                                                                                                                                                              • Key, xrefs: 002B3013
                                                                                                                                                                                                                                              • Name, xrefs: 002B3055
                                                                                                                                                                                                                                              • Invalid substitutor, xrefs: 002B3005
                                                                                                                                                                                                                                              • Unable to substitute variables for the DEL_REG_VALUE command, xrefs: 002B31BC
                                                                                                                                                                                                                                              • Error opening HKLM registry key: %d, xrefs: 002B30FC
                                                                                                                                                                                                                                              • Error (%d) deleting registry value (%s) in key: %s, xrefs: 002B319D
                                                                                                                                                                                                                                              • NWebAdvisor::NXmlUpdater::parse_and_execute, xrefs: 002B3103, 002B315E, 002B31A4, 002B31CC
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp, xrefs: 002B3108, 002B3163, 002B31A9, 002B31D1
                                                                                                                                                                                                                                              • Unable to read Key or Name for DEL_REG_VALUE command, xrefs: 002B31C5
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseOpen
                                                                                                                                                                                                                                              • String ID: Cannnot delete registry value. Key or value not found. Key: %s Value: %s$Error (%d) deleting registry value (%s) in key: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Name$Unable to read Key or Name for DEL_REG_VALUE command$Unable to substitute variables for the DEL_REG_VALUE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp
                                                                                                                                                                                                                                              • API String ID: 47109696-1081640057
                                                                                                                                                                                                                                              • Opcode ID: 96db1875bbfc0caf4aabfb7045b695d6ca855d79e9b630a05333a150f5fae41f
                                                                                                                                                                                                                                              • Instruction ID: 7020ce11aa109e5db9007e2b83c0bc1d45763b15047346779ccf8fd3fcba11df
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 96db1875bbfc0caf4aabfb7045b695d6ca855d79e9b630a05333a150f5fae41f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8651D170A61319ABDB11DF84DC46BEEB7BDEF05B44F140518F9047B281DBB0AA24CBA0
                                                                                                                                                                                                                                              Function 00298400 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 152COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,0034F278,00000023,00000001,00000004,00000000,00000000), ref: 00298462
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(0034F278,00000000,0034F278,00000104,\McAfee\), ref: 00298491
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0029849D
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(0034F278,00000000,0034F278,00000104,0034F070), ref: 002984C5
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002984CB
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00000104), ref: 002984FC
                                                                                                                                                                                                                                              • StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00298511
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(0034F278,00000000,0034F278,00000104,00000000), ref: 0029852E
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00298534
                                                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 002985B9
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CreateDirectoryErrorLast$CountFileFolderModuleNamePathSpecialTick
                                                                                                                                                                                                                                              • String ID: %uFile:%sFunction:%sLine:%d$\McAfee\$\log.txt
                                                                                                                                                                                                                                              • API String ID: 922589859-3713371193
                                                                                                                                                                                                                                              • Opcode ID: 252450e8781b8452c4e400f32297f45ffe6697cdfaeeaaff7a59ac777083beb3
                                                                                                                                                                                                                                              • Instruction ID: 39a9bf0f21767dff591c3a7862d68080f51a9d334ac3046cb392e178ce6cb562
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 252450e8781b8452c4e400f32297f45ffe6697cdfaeeaaff7a59ac777083beb3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D5511C79A90309AFEF21AF64DC46FD973F8AF15700F1905A1F908AB191CBF0A9908F51
                                                                                                                                                                                                                                              Function 002ECE60 Relevance: 22.9, APIs: 15, Instructions: 357COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$Info
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2509303402-0
                                                                                                                                                                                                                                              • Opcode ID: bba5fb0b59b646797124ae631098c3ab190cac4338d1852ac24e3cfe48e2e35c
                                                                                                                                                                                                                                              • Instruction ID: 0c42a576cde3cd0b655dd6dc2ecfafec0c5772020ea7ea2121678adf31c43939
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bba5fb0b59b646797124ae631098c3ab190cac4338d1852ac24e3cfe48e2e35c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 80D1BD7191034A9FDB21CFB9C881BEEFBF5BF19300F544069E999AB342DA70A855CB50
                                                                                                                                                                                                                                              Function 002E5A69 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 403COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,00000003,?,?), ref: 002E5B0F
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,00000003,?,?), ref: 002E5B33
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Module$FileHandleName
                                                                                                                                                                                                                                              • String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program: $\
                                                                                                                                                                                                                                              • API String ID: 4146042529-3261600717
                                                                                                                                                                                                                                              • Opcode ID: 598072fe924593ad6de4dacea3a546673da6047c402c13cec1f03aeb5381cff1
                                                                                                                                                                                                                                              • Instruction ID: fec57fcd976de56f01764a1f8ecce10155467b6ccaf72caac59fdb9915673d00
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 598072fe924593ad6de4dacea3a546673da6047c402c13cec1f03aeb5381cff1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FFC17F71AB056766DB246E268C8AFFB336CEFA5748F840168FC09D5102F7348E7189A0
                                                                                                                                                                                                                                              Function 0027D972 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 374COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 0026BA20: Concurrency::cancel_current_task.LIBCPMT ref: 0026BB9D
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027DBE9
                                                                                                                                                                                                                                                • Part of subcall function 0027D740: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027D7E7
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027DB35
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027DF0C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitialize
                                                                                                                                                                                                                                              • String ID: &se=$&sig=$&skn=$Event Sender already initialized for Azure$Failed to create HMACSha256 Hash$Failed to escape hash$SharedAccessSignature sr=$`3$`3
                                                                                                                                                                                                                                              • API String ID: 3638550806-3838580404
                                                                                                                                                                                                                                              • Opcode ID: dda9a8436a08f256bb38795ff85454cd6a3426cf25b2995f8aafad6cb8ca5430
                                                                                                                                                                                                                                              • Instruction ID: 0aa3698d19061e06b2a8b0cfe6af823c49da839b68baf2fefc39017560ac5363
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dda9a8436a08f256bb38795ff85454cd6a3426cf25b2995f8aafad6cb8ca5430
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C7E11171D202589BDF29DBA4CC89BDDB779AF45304F108298E409A7281EB74AFE4CF51
                                                                                                                                                                                                                                              Function 002A0950 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 244fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002A0490: CreateDirectoryW.KERNEL32(?,00000000,?), ref: 002A04AA
                                                                                                                                                                                                                                                • Part of subcall function 002A0490: GetLastError.KERNEL32 ref: 002A04B8
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000000,00000000,00000000,0000005C,00000001,00000000), ref: 002A0BB5
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002A0BC2
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CreateErrorLast$DirectoryFile
                                                                                                                                                                                                                                              • String ID: _)$CreateDir failed for %s$CreateFile failed for %s: %d$NWebAdvisor::NUtils::StoreBufferInFile$WriteFile failed: %d$\$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileUtils.cpp
                                                                                                                                                                                                                                              • API String ID: 1552088572-1639435073
                                                                                                                                                                                                                                              • Opcode ID: 5d9a28c31f02f64d0d6a13d4c11600bc94ae4b59cf34e9882c6113609c9679d2
                                                                                                                                                                                                                                              • Instruction ID: 94036529718e7dfce381243d8bdf8ca37699f15de0934f6287b037afe3fb13ac
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5d9a28c31f02f64d0d6a13d4c11600bc94ae4b59cf34e9882c6113609c9679d2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1A1BD70D10349DFDF01DFA4C885BEEBBB4AF19718F144219E905BB181EBB06A95CBA1
                                                                                                                                                                                                                                              Function 002B3300 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 217registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 002B3545
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Close
                                                                                                                                                                                                                                              • String ID: Cannnot delete registry key. Not found: %s$Error (%d) deleting registry key tree: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Unable to read Key for DEL_REG_TREE command$Unable to substitute variables for the DEL_REG_TREE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_tree_command.cpp
                                                                                                                                                                                                                                              • API String ID: 3535843008-3762851336
                                                                                                                                                                                                                                              • Opcode ID: a804936e59307adf92f8b83a30b27a5f0b6592bbac4969b06ec6e167bf021e3d
                                                                                                                                                                                                                                              • Instruction ID: 02d2d66654f8c68f09fe4345e1d43b308e22a428c62ddbbae2580b4999751216
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a804936e59307adf92f8b83a30b27a5f0b6592bbac4969b06ec6e167bf021e3d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 31710371A60315EBDF21DF54D842BEEB7B4FF09B40F944514E9157B281CBB0AA54CBA0
                                                                                                                                                                                                                                              Function 002FB4F0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 200COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free
                                                                                                                                                                                                                                              • String ID: xx5$xx5$|x5
                                                                                                                                                                                                                                              • API String ID: 269201875-1102812817
                                                                                                                                                                                                                                              • Opcode ID: 2eee9d22ff0a20fc4af50251a14cbdc573a3cf2a3972f94241423ff27cb65948
                                                                                                                                                                                                                                              • Instruction ID: c56c91564a2884e5a237265daa2c56a4ba8c7e756452215fd314bc843178f3ad
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2eee9d22ff0a20fc4af50251a14cbdc573a3cf2a3972f94241423ff27cb65948
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9061D172920709DFDB21DF64C841BBAF7E8AB55390F244439EA46EB281EB70AD148B50
                                                                                                                                                                                                                                              Function 0028BDF0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 168COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0028BE2F
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0028BE51
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0028BE71
                                                                                                                                                                                                                                              • std::_Locinfo::~_Locinfo.LIBCPMT ref: 0028BFCD
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 0028BFDA
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0028BFFC
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0028C01E
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0028C023
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0028C028
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Concurrency::cancel_current_task$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
                                                                                                                                                                                                                                              • String ID: false$true$}Y,
                                                                                                                                                                                                                                              • API String ID: 2461315636-2810365136
                                                                                                                                                                                                                                              • Opcode ID: 5b7172074193f8170c2c566f4a2512b5ed289a7646bd761010fb60001e2212f3
                                                                                                                                                                                                                                              • Instruction ID: e688332f51cd8c62bf895e9ad1298b6741bb9fdeebfdac86650689ce67875993
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b7172074193f8170c2c566f4a2512b5ed289a7646bd761010fb60001e2212f3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B7612174A21346DFCB12EF64C841BAEBBB4BF04300F10855DE905AB391DBB5AA25CF91
                                                                                                                                                                                                                                              Function 002D87E7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • InitializeCriticalSectionAndSpinCount.KERNEL32(0035742C,00000FA0,?,?,002D87C5), ref: 002D87F3
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,002D87C5), ref: 002D87FE
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,002D87C5), ref: 002D880F
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 002D8821
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 002D882F
                                                                                                                                                                                                                                              • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,002D87C5), ref: 002D8852
                                                                                                                                                                                                                                              • DeleteCriticalSection.KERNEL32(0035742C,00000007,?,?,002D87C5), ref: 002D8875
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,002D87C5), ref: 002D8885
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • kernel32.dll, xrefs: 002D880A
                                                                                                                                                                                                                                              • WakeAllConditionVariable, xrefs: 002D8827
                                                                                                                                                                                                                                              • SleepConditionVariableCS, xrefs: 002D881B
                                                                                                                                                                                                                                              • api-ms-win-core-synch-l1-2-0.dll, xrefs: 002D87F9
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                                                                              • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                                                                              • API String ID: 2565136772-3242537097
                                                                                                                                                                                                                                              • Opcode ID: 7d3c63e372c3a13d0947e22b5d2448d79d1619b8f680e50dc6058e6ec0309cc7
                                                                                                                                                                                                                                              • Instruction ID: 665dd067b9185b4ba25393636ffe68f9dd08819c7611ff3456d198c88ca60b36
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d3c63e372c3a13d0947e22b5d2448d79d1619b8f680e50dc6058e6ec0309cc7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0101D471A54322ABD7235F76BC09FE63E6DAB88B52F054432FD05E32A0DEB1CC109661
                                                                                                                                                                                                                                              Function 002FBC3F Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___free_lconv_mon.LIBCMT ref: 002FBC83
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FAFE4
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FAFF6
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB008
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB01A
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB02C
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB03E
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB050
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB062
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB074
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB086
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB098
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB0AA
                                                                                                                                                                                                                                                • Part of subcall function 002FAFC7: _free.LIBCMT ref: 002FB0BC
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBC78
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: RtlFreeHeap.NTDLL(00000000,00000000,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?), ref: 002F20AE
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: GetLastError.KERNEL32(?,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?,?), ref: 002F20C0
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBC9A
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBCAF
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBCBA
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBCDC
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBCEF
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBCFD
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBD08
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBD40
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBD47
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBD64
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBD7C
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 161543041-0
                                                                                                                                                                                                                                              • Opcode ID: 7fcea6597031812b214016b0574b7e1e588b0cef31cd44c402ee0e9b38e97c7d
                                                                                                                                                                                                                                              • Instruction ID: 09cd8398367d9114d139889f4c840a113cc8bfbb32997b4457940f342153c886
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7fcea6597031812b214016b0574b7e1e588b0cef31cd44c402ee0e9b38e97c7d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 72314C7251070ADFEB226E35D805B66F3E9EF21390F14483AE659E6251DF31E868CB11
                                                                                                                                                                                                                                              Function 002FB0D0 Relevance: 18.4, APIs: 12, Instructions: 374COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 269201875-0
                                                                                                                                                                                                                                              • Opcode ID: 7391127ddfba6c84277e7842167e9469dbc0a9796c627f1069b525fb14b87062
                                                                                                                                                                                                                                              • Instruction ID: 550699b10bd67a9484d37fabdfaef217503669c5889bdc808b7433a491469802
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7391127ddfba6c84277e7842167e9469dbc0a9796c627f1069b525fb14b87062
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9C12276D50609AFDB20DBA8CC42FAEF7E8AB19740F144165FF05FB282D670AD548B90
                                                                                                                                                                                                                                              Function 002991A0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,0033A536,00000003), ref: 002991C9
                                                                                                                                                                                                                                              • FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 002991DE
                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00000000,00000000), ref: 002991EE
                                                                                                                                                                                                                                              • LockResource.KERNEL32(00000000), ref: 002991FD
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • kernel32.dll, xrefs: 002991B8
                                                                                                                                                                                                                                              • %d.%d.%d.%d, xrefs: 0029925E
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp, xrefs: 00299284, 0029933B
                                                                                                                                                                                                                                              • Failed to retrieve kernel verison, xrefs: 0029932C
                                                                                                                                                                                                                                              • NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion, xrefs: 0029927F, 00299336
                                                                                                                                                                                                                                              • Failed to format version, xrefs: 00299275
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Resource$FindHandleLoadLockModule
                                                                                                                                                                                                                                              • String ID: %d.%d.%d.%d$Failed to format version$Failed to retrieve kernel verison$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32.dll
                                                                                                                                                                                                                                              • API String ID: 3968257194-3470154288
                                                                                                                                                                                                                                              • Opcode ID: 0caf89bb7d9c3e0fa3567d988816dc3cfcb02baaed7769f8ea1081d49b1726dc
                                                                                                                                                                                                                                              • Instruction ID: a472104c89cbd5cd912a56e5408f5e6e3d0ef4d8ab30b991e225bcda02f6695b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0caf89bb7d9c3e0fa3567d988816dc3cfcb02baaed7769f8ea1081d49b1726dc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E5513C746003119BDF249F29DC45BABB7B8EF08704F0045DDE909AB2C2DB76AE91CB94
                                                                                                                                                                                                                                              Function 00279C10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 369COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __Mtx_destroy_in_situ.LIBCPMT ref: 00279C1A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Wait timeout. Should not have gotten this..., xrefs: 0027A86F
                                                                                                                                                                                                                                              • Wait failed: , xrefs: 0027A93F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Mtx_destroy_in_situ
                                                                                                                                                                                                                                              • String ID: Wait failed: $Wait timeout. Should not have gotten this...
                                                                                                                                                                                                                                              • API String ID: 3543493169-4232610396
                                                                                                                                                                                                                                              • Opcode ID: 6d3b217a09607d682b2a386395af664cda685a4e02810db9f230f79f2b5f61ac
                                                                                                                                                                                                                                              • Instruction ID: 82be1a9e6cd2f73819794c8905509a175c2026662508eac6b8585da7f925e715
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d3b217a09607d682b2a386395af664cda685a4e02810db9f230f79f2b5f61ac
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0AE1BCB0920B059FDB24DF64C884BEBB7E9BF44314F004A1DE55A97680DB74A9A4CF92
                                                                                                                                                                                                                                              Function 002DC338 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 002DC435
                                                                                                                                                                                                                                              • type_info::operator==.LIBVCRUNTIME ref: 002DC457
                                                                                                                                                                                                                                              • ___TypeMatch.LIBVCRUNTIME ref: 002DC566
                                                                                                                                                                                                                                              • IsInExceptionSpec.LIBVCRUNTIME ref: 002DC638
                                                                                                                                                                                                                                              • _UnwindNestedFrames.LIBCMT ref: 002DC6BC
                                                                                                                                                                                                                                              • CallUnexpected.LIBVCRUNTIME ref: 002DC6D7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                              • API String ID: 2123188842-393685449
                                                                                                                                                                                                                                              • Opcode ID: 35779435ef35de10fae70791d5c20b08598c26ae6b563abe36bd573f208ee8ef
                                                                                                                                                                                                                                              • Instruction ID: 40cc6af9cc7c2df4360d1061f7478daf8ec8316a0ae5bd8dbaf881ed8f9f78e8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 35779435ef35de10fae70791d5c20b08598c26ae6b563abe36bd573f208ee8ef
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9AB1377182020AEFCF19DFA4D9819AEBBB9BF44310B24415BE8156B312D731EE61CF91
                                                                                                                                                                                                                                              Function 002769A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(1CE34B5F,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 002769E9
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(1CE34B5F,?,?,00000000), ref: 002769FB
                                                                                                                                                                                                                                              • DeviceIoControl.KERNEL32(00000000,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 00276A2A
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00276A3D
                                                                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mfeaaca.dll,?), ref: 00276A8B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,NotComDllUnload), ref: 00276A9E
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 00276AB8
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Handle$CloseControlDevice$AddressFreeLibraryModuleProc
                                                                                                                                                                                                                                              • String ID: NotComDllUnload$mfeaaca.dll
                                                                                                                                                                                                                                              • API String ID: 2321898493-1077453148
                                                                                                                                                                                                                                              • Opcode ID: e5911fb4ee2a3346eddb5cf1a3ef9a2b8d515a0f96a5e1417437d64e0aebfd1a
                                                                                                                                                                                                                                              • Instruction ID: 5ff2b698b6e7f1fc4f97e993caa9d1c8b77160ab72b30ca710185cffd8934840
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e5911fb4ee2a3346eddb5cf1a3ef9a2b8d515a0f96a5e1417437d64e0aebfd1a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D31D5713107029BDB219F25DC8DF6A7798AF48B10F188619FD19EB2D0DB71EC14CA51
                                                                                                                                                                                                                                              Function 002B4280 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 133COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • NWebAdvisor::CHttpTransaction::SetAutoProxyUrl, xrefs: 002B4388
                                                                                                                                                                                                                                              • # SetAutoProxyUrl: Can't get proxy. Err: %d, xrefs: 002B4381
                                                                                                                                                                                                                                              • NWebAdvisor::CHttpTransaction::SetAutoProxy, xrefs: 002B4325
                                                                                                                                                                                                                                              • NWebAdvisor::CHttpTransaction::Connect, xrefs: 002B43D8
                                                                                                                                                                                                                                              • Unable to set proxy option, error: %d, xrefs: 002B43CE
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp, xrefs: 002B432A, 002B438D, 002B43DD
                                                                                                                                                                                                                                              • # SetAutoProxy: Can't get proxy. Err: %d, xrefs: 002B431E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast
                                                                                                                                                                                                                                              • String ID: # SetAutoProxy: Can't get proxy. Err: %d$# SetAutoProxyUrl: Can't get proxy. Err: %d$NWebAdvisor::CHttpTransaction::Connect$NWebAdvisor::CHttpTransaction::SetAutoProxy$NWebAdvisor::CHttpTransaction::SetAutoProxyUrl$Unable to set proxy option, error: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp
                                                                                                                                                                                                                                              • API String ID: 1452528299-2881327693
                                                                                                                                                                                                                                              • Opcode ID: 2f419bd156d089543420f5c302a421b49821facb679d1b5e06cf30eb49c8ead6
                                                                                                                                                                                                                                              • Instruction ID: 5b746381be23d219390d19fb6e44c70b2c20fe77e40b82d3bd2e832e765d5368
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2f419bd156d089543420f5c302a421b49821facb679d1b5e06cf30eb49c8ead6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E2418171A4031AEFEB11DFA4DC85BEEF7F8EF08714F14805AE914A6281D7B19950CBA4
                                                                                                                                                                                                                                              Function 002F1B91 Relevance: 15.1, APIs: 10, Instructions: 69COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BA7
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: RtlFreeHeap.NTDLL(00000000,00000000,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?), ref: 002F20AE
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: GetLastError.KERNEL32(?,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?,?), ref: 002F20C0
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BB3
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BBE
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BC9
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BD4
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BDF
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BEA
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1BF5
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1C00
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1C0E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 776569668-0
                                                                                                                                                                                                                                              • Opcode ID: fbc22c863ee1a8cd5da7fca90dbe4250bd802482e98e42939840ad4bb7d060cb
                                                                                                                                                                                                                                              • Instruction ID: 019ec55f8c59b706867e6fc24a5dbc782c52f1baaa7dae1fba76364b0f57cb35
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fbc22c863ee1a8cd5da7fca90dbe4250bd802482e98e42939840ad4bb7d060cb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E216B7691010CEFCB41EFA4C851DEDBBB9AF19380F4145A9B615AB221DB31DA68CF80
                                                                                                                                                                                                                                              Function 002DE00A Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 496COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __aulldvrm
                                                                                                                                                                                                                                              • String ID: :$f$f$f$p$p$p
                                                                                                                                                                                                                                              • API String ID: 1302938615-1434680307
                                                                                                                                                                                                                                              • Opcode ID: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
                                                                                                                                                                                                                                              • Instruction ID: a0011e8b16a7030f554ce48eb10964749f74024de26aaa252f84e4f34e1d5e43
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE029075A20219DADF20AFA4D4887EDB7BAFB04B14FA64157D414BF380D3B09DA8CB15
                                                                                                                                                                                                                                              Function 002D6940 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D6947
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::_Lockit.LIBCPMT ref: 0028C995
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::_Lockit.LIBCPMT ref: 0028C9B7
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0028C9D7
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0028CAB1
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
                                                                                                                                                                                                                                              • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                                                                                                                                                                                                                              • API String ID: 1383202999-2891247106
                                                                                                                                                                                                                                              • Opcode ID: b9e005a7688587cc8662e7ad5f549799a8926792d837528efdd76f7bcf91be76
                                                                                                                                                                                                                                              • Instruction ID: 4ce0cd316f29c4762e5324d0a24982c7acf7adf278bb2d85360596ea6029dad8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b9e005a7688587cc8662e7ad5f549799a8926792d837528efdd76f7bcf91be76
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 50B16B7152010AAFDF19DF68C95DDFE3BB9EB15304F04411BFA82A6391D6719E209B60
                                                                                                                                                                                                                                              Function 002D1610 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D1617
                                                                                                                                                                                                                                                • Part of subcall function 002C7DF0: __EH_prolog3.LIBCMT ref: 002C7DF7
                                                                                                                                                                                                                                                • Part of subcall function 002C7DF0: std::_Lockit::_Lockit.LIBCPMT ref: 002C7E01
                                                                                                                                                                                                                                                • Part of subcall function 002C7DF0: std::_Lockit::~_Lockit.LIBCPMT ref: 002C7E72
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
                                                                                                                                                                                                                                              • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                                                                                                                                                                                                                              • API String ID: 1538362411-2891247106
                                                                                                                                                                                                                                              • Opcode ID: 2e56551a41591cf9c0121915a6324f56031c223d5450289415598def269fe100
                                                                                                                                                                                                                                              • Instruction ID: 622e424d7caf86306563cad298975452090e12841babaddf0b0e74ea42dde930
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2e56551a41591cf9c0121915a6324f56031c223d5450289415598def269fe100
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 59B17C7192010ABFEF19DE68C965DFE7BB9AB05300F14411AF902A6BA1D6319E30DB61
                                                                                                                                                                                                                                              Function 002D19E0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D19E7
                                                                                                                                                                                                                                                • Part of subcall function 002632DE: __EH_prolog3_GS.LIBCMT ref: 002632E5
                                                                                                                                                                                                                                                • Part of subcall function 002632DE: std::_Lockit::_Lockit.LIBCPMT ref: 002632F2
                                                                                                                                                                                                                                                • Part of subcall function 002632DE: std::_Lockit::~_Lockit.LIBCPMT ref: 00263360
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
                                                                                                                                                                                                                                              • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                                                                                                                                                                                                                              • API String ID: 2728201062-2891247106
                                                                                                                                                                                                                                              • Opcode ID: 4cb4d10565e8ce2eaa7b69b1499baf85e1dd5694758a485429fe97b305afb870
                                                                                                                                                                                                                                              • Instruction ID: a2c9996078ce8d089bc464fdbbefd693136917f9958d4fe165b4b8589f94068d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4cb4d10565e8ce2eaa7b69b1499baf85e1dd5694758a485429fe97b305afb870
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F4B19A7166010ABBCF19DE68C966EBE3BBAEF05304F14411BF902A6B51D6719E30DB21
                                                                                                                                                                                                                                              Function 002B0C80 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 244fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00000000,?,?,1CE34B5F,00000000), ref: 002B0E20
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002B0E2E
                                                                                                                                                                                                                                                • Part of subcall function 002B0FA0: GetModuleHandleW.KERNEL32(kernel32.dll,1CE34B5F,000000FF,00000000,00000000,0030DF30,000000FF), ref: 002B0FE8
                                                                                                                                                                                                                                                • Part of subcall function 002B0FA0: GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 002B0FF8
                                                                                                                                                                                                                                                • Part of subcall function 002B0FA0: GetLastError.KERNEL32 ref: 002B1058
                                                                                                                                                                                                                                                • Part of subcall function 00298650: std::locale::_Init.LIBCPMT ref: 0029882F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 002B0DA0, 002B0E41, 002B0F11
                                                                                                                                                                                                                                              • CreateFile failed: %d, xrefs: 002B0E35
                                                                                                                                                                                                                                              • Unable to create destination directory (%d), xrefs: 002B0D94
                                                                                                                                                                                                                                              • NWebAdvisor::CCabParser::LoadCabFile, xrefs: 002B0F0C
                                                                                                                                                                                                                                              • NWebAdvisor::CCabParser::GetContentFile, xrefs: 002B0D9B, 002B0E3C
                                                                                                                                                                                                                                              • Failed to load cab %s, xrefs: 002B0F05
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$AddressCreateFileHandleInitModuleProcstd::locale::_
                                                                                                                                                                                                                                              • String ID: CreateFile failed: %d$Failed to load cab %s$NWebAdvisor::CCabParser::GetContentFile$NWebAdvisor::CCabParser::LoadCabFile$Unable to create destination directory (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
                                                                                                                                                                                                                                              • API String ID: 1808632809-3418505487
                                                                                                                                                                                                                                              • Opcode ID: fcef798fe7e3a0948e233b1b61433eaf9871ef7c5fb4ccc3e63e7dbe99b98b94
                                                                                                                                                                                                                                              • Instruction ID: 8f8938a44cf5c5d7de7b927cf1fe552911e92a1a867f231a2f36cc8d6daeeea8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fcef798fe7e3a0948e233b1b61433eaf9871ef7c5fb4ccc3e63e7dbe99b98b94
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 87919171A10208AFDB15DFA4D896BEEB7B8EF04704F208129F515A7281DB71AA55CFA0
                                                                                                                                                                                                                                              Function 002C1B90 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CertGetCertificateContextProperty.CRYPT32(00000000,00000003,00000000,?), ref: 002C1CB1
                                                                                                                                                                                                                                              • CertGetCertificateContextProperty.CRYPT32(00000000,00000003,00000000,?), ref: 002C1CE5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CertCertificateContextProperty
                                                                                                                                                                                                                                              • String ID: 1.2.840.10045.4.1$1.2.840.10045.4.3$1.2.840.10045.4.3.2$1.2.840.10045.4.3.3$1.2.840.10045.4.3.4$MUSARUBRA US LLC
                                                                                                                                                                                                                                              • API String ID: 665277682-2910604786
                                                                                                                                                                                                                                              • Opcode ID: 6a16688f28a318477f7b7492a7bbe52d7c5255f3d570394ea179f6ca7a06e5a6
                                                                                                                                                                                                                                              • Instruction ID: f30a628117fa344890145d2d855c51271f8e31acb2d642b07e33ee4110771f8f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a16688f28a318477f7b7492a7bbe52d7c5255f3d570394ea179f6ca7a06e5a6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 805123716103024BDB24DF24D883F66B7A1AF42720F48476EF85A8B353D721ED35CA92
                                                                                                                                                                                                                                              Function 002CDE9D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002CDEA4
                                                                                                                                                                                                                                              • _Maklocstr.LIBCPMT ref: 002CDF0D
                                                                                                                                                                                                                                              • _Maklocstr.LIBCPMT ref: 002CDF1F
                                                                                                                                                                                                                                              • _Maklocchr.LIBCPMT ref: 002CDF37
                                                                                                                                                                                                                                              • _Maklocchr.LIBCPMT ref: 002CDF47
                                                                                                                                                                                                                                              • _Getvals.LIBCPMT ref: 002CDF69
                                                                                                                                                                                                                                                • Part of subcall function 002C760B: _Maklocchr.LIBCPMT ref: 002C763A
                                                                                                                                                                                                                                                • Part of subcall function 002C760B: _Maklocchr.LIBCPMT ref: 002C7650
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
                                                                                                                                                                                                                                              • String ID: false$true
                                                                                                                                                                                                                                              • API String ID: 3549167292-2658103896
                                                                                                                                                                                                                                              • Opcode ID: e59d88586879ac39a73095ec08d26470283cd76a259c19a150b7e5c7825c12e5
                                                                                                                                                                                                                                              • Instruction ID: 28e2efbc7fa27e15f8e12a5059e808e77ef766a10d2e1d501ff055250a6e727a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e59d88586879ac39a73095ec08d26470283cd76a259c19a150b7e5c7825c12e5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 42214172D14208AADF15EFA4D885EDEBB68EF04710F00855AF9059F291EB708954CFA1
                                                                                                                                                                                                                                              Function 002FF5F9 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 74b4ca1a923cb7bb2ad53c7e3ed490095818df73553c45d6e383aab588253396
                                                                                                                                                                                                                                              • Instruction ID: 65f56de0e9faf6193c1dd639a8192c5a652ea1a1b1f08281dde5a1531b589936
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 74b4ca1a923cb7bb2ad53c7e3ed490095818df73553c45d6e383aab588253396
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CCC1E27092424AAFDB15DFA8D980BBDFBB4AF49390F0440B9E6159B392C7719D21CF60
                                                                                                                                                                                                                                              Function 002AC600 Relevance: 13.7, APIs: 9, Instructions: 240COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::locale::_Init.LIBCPMT ref: 002AC641
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: __EH_prolog3.LIBCMT ref: 002C308B
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::_Lockit::_Lockit.LIBCPMT ref: 002C3096
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::locale::_Setgloballocale.LIBCPMT ref: 002C30B1
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::_Lockit::~_Lockit.LIBCPMT ref: 002C3107
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002AC6CB
                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002AC713
                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 002AC748
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002AC7DD
                                                                                                                                                                                                                                                • Part of subcall function 002DE960: _free.LIBCMT ref: 002DE973
                                                                                                                                                                                                                                              • std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 002AC807
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002AC82B
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002AC84C
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002AC85B
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$std::locale::_$Lockit::_Lockit::~_$Locimp::_Locinfo::_$AddfacH_prolog3InitLocimpLocimp_Locinfo_ctorLocinfo_dtorNew_Setgloballocale_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3142054045-0
                                                                                                                                                                                                                                              • Opcode ID: 20e7ea26a22f89241a20501bb1fd674c62640bb1018ea89e44feca38be44c3b1
                                                                                                                                                                                                                                              • Instruction ID: 26e044e45f52735a50c6f681bd762c50b938dea5d5a3715ba0310588842972e1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 20e7ea26a22f89241a20501bb1fd674c62640bb1018ea89e44feca38be44c3b1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4DA1ACB0D103499FEB11DFA8D845B9EBBF4BF05304F144529E405AB391EBB5AA14CF91
                                                                                                                                                                                                                                              Function 002A1CF0 Relevance: 13.7, APIs: 9, Instructions: 240COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::locale::_Init.LIBCPMT ref: 002A1D31
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: __EH_prolog3.LIBCMT ref: 002C308B
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::_Lockit::_Lockit.LIBCPMT ref: 002C3096
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::locale::_Setgloballocale.LIBCPMT ref: 002C30B1
                                                                                                                                                                                                                                                • Part of subcall function 002C3084: std::_Lockit::~_Lockit.LIBCPMT ref: 002C3107
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002A1DBB
                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002A1E03
                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 002A1E38
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002A1ECD
                                                                                                                                                                                                                                                • Part of subcall function 002DE960: _free.LIBCMT ref: 002DE973
                                                                                                                                                                                                                                              • std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 002A1EF7
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002A1F1B
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002A1F3C
                                                                                                                                                                                                                                              • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 002A1F4B
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$std::locale::_$Lockit::_Lockit::~_$Locimp::_Locinfo::_$AddfacH_prolog3InitLocimpLocimp_Locinfo_ctorLocinfo_dtorNew_Setgloballocale_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3142054045-0
                                                                                                                                                                                                                                              • Opcode ID: 1d3620d98d1a63645f1fcd5a433cd420c3f8ca25fd5d30653be4b3990ef23758
                                                                                                                                                                                                                                              • Instruction ID: fbffad22ca93494c7afec04029a05ac90c7aee70615b8d9e1f13eee0f8657691
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1d3620d98d1a63645f1fcd5a433cd420c3f8ca25fd5d30653be4b3990ef23758
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9EA1CCB0D103859FEB10DFA8D845B9EBBF4BF05304F14451AE805AB352EBB5AA24CF91
                                                                                                                                                                                                                                              Function 002C394B Relevance: 13.6, APIs: 9, Instructions: 139threadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3943753294-0
                                                                                                                                                                                                                                              • Opcode ID: f448c76ff273324d285125de96c4b315a8382e61ddde7ad055e2ed0029734948
                                                                                                                                                                                                                                              • Instruction ID: 34cc5f1bc37b78a2e68d8f4143cb66bb6481581a089262c930bb81450e649a12
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f448c76ff273324d285125de96c4b315a8382e61ddde7ad055e2ed0029734948
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 68515934920606CFCF10DF25C585EA9B7B4FB08310B25CA5EE846AB251DB71EE60CFA1
                                                                                                                                                                                                                                              Function 002AE760 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 002AE877
                                                                                                                                                                                                                                              • CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000014), ref: 002AE8A9
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CertCertificateContextProperty
                                                                                                                                                                                                                                              • String ID: 1.2.840.10045.4.1$1.2.840.10045.4.3$1.2.840.10045.4.3.2$1.2.840.10045.4.3.3$1.2.840.10045.4.3.4
                                                                                                                                                                                                                                              • API String ID: 665277682-3196566809
                                                                                                                                                                                                                                              • Opcode ID: 9a028e69286e9fabd3efd6ddec0f683e35ac74a24f148234e1ffb7f396fdc4ad
                                                                                                                                                                                                                                              • Instruction ID: 1e3bc27a4845ea48f80fd93f238106e2e8e631b984aab9b44e9cfc1d6589d607
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a028e69286e9fabd3efd6ddec0f683e35ac74a24f148234e1ffb7f396fdc4ad
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2510A71A103179FCF219F25D891BAAB765AF12320F0642A9DC199B352DF31ED25CB90
                                                                                                                                                                                                                                              Function 0028E2C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: z
                                                                                                                                                                                                                                              • API String ID: 0-1657960367
                                                                                                                                                                                                                                              • Opcode ID: ed3da8299b00bd776efc2e02b1d1f4cfb84abaebcb2f972811177f3be8b2887c
                                                                                                                                                                                                                                              • Instruction ID: 732062a8b815df41106feb43e165132ecbd9c8dad558422cad332e9beae7c2c4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ed3da8299b00bd776efc2e02b1d1f4cfb84abaebcb2f972811177f3be8b2887c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40518F75A11209ABEF11EF94CC84FEEB7B8FB48324F114169E915A3281D775AD14CFA0
                                                                                                                                                                                                                                              Function 00277107 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 163COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00277D3D
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 00277DC8
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00277DFC
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00277EBB
                                                                                                                                                                                                                                                • Part of subcall function 00284B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0028521E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
                                                                                                                                                                                                                                              • String ID: Failed to add event category ($Service has not been initialized$V
                                                                                                                                                                                                                                              • API String ID: 342047005-375236208
                                                                                                                                                                                                                                              • Opcode ID: a256d83dca90360a9a8c5612c51a0ccc16cf6487e083dbae455f768e4d46d370
                                                                                                                                                                                                                                              • Instruction ID: aca3f0952602d3c83efca29153b754c0e27af2d7915d6daa58018d8f12ae9308
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a256d83dca90360a9a8c5612c51a0ccc16cf6487e083dbae455f768e4d46d370
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1951E071924248CFDB14EF60D856BEE77B8FF04304F5041A9E80A97281EF75AA68CF61
                                                                                                                                                                                                                                              Function 0027A6B6 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 135COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,1CE34B5F,?,?), ref: 0027A531
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 0027A73D
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027A7AC
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027A989
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
                                                                                                                                                                                                                                              • String ID: Event string is empty$Unexpected return value: $`3
                                                                                                                                                                                                                                              • API String ID: 1703231451-38556525
                                                                                                                                                                                                                                              • Opcode ID: c5602474e14804eef2a15948a7ca52b3d152d12e5917846af7a14be265ede1b5
                                                                                                                                                                                                                                              • Instruction ID: e69fd99544dd02cf7af1ca57b2a645d6a6b96ae3fa50dcc1cfdac65ac66bbd06
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c5602474e14804eef2a15948a7ca52b3d152d12e5917846af7a14be265ede1b5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F51D270920208DBDB18DFA4CC89BDDB779AF91324F108298E0195B2C1CB70AAE5CF52
                                                                                                                                                                                                                                              Function 0027D87D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 110COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027D8F5
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027DF0C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID: Event Sender already initialized for Azure$Failed to encode url$`3$`3$~
                                                                                                                                                                                                                                              • API String ID: 1656330964-4154226584
                                                                                                                                                                                                                                              • Opcode ID: c57a52c5dbf76ac3127e0645b0e7d032f1059c24204a8529bb6f5b125c8d7f53
                                                                                                                                                                                                                                              • Instruction ID: e4a84aa7832ffd61ba7384e344522c94b2b7b0b6630652fd986a865ce754641e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c57a52c5dbf76ac3127e0645b0e7d032f1059c24204a8529bb6f5b125c8d7f53
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1B4112749242589BDB15EF60DC85BDDB3B9EF45314F004299E80967280EF716EA8CFA1
                                                                                                                                                                                                                                              Function 0028BBB0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0028BBE6
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0028BC06
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0028BC26
                                                                                                                                                                                                                                              • std::_Locinfo::~_Locinfo.LIBCPMT ref: 0028BCB4
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 0028BCC1
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0028BCE3
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
                                                                                                                                                                                                                                              • String ID: `Y,
                                                                                                                                                                                                                                              • API String ID: 2966223926-3996621004
                                                                                                                                                                                                                                              • Opcode ID: da9313b22f233c609b0d78111d0ef6542dbf970b474c09c0421706c09d87bfd5
                                                                                                                                                                                                                                              • Instruction ID: 547fd82287874377f3a9d74695912f10e25a6c5eab671547dd8dfbe581bcd8f8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: da9313b22f233c609b0d78111d0ef6542dbf970b474c09c0421706c09d87bfd5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D941CC799112098FCB02EF54C881BAEBBB8FF54310F14455EE8066B3A1CF70AE15CB81
                                                                                                                                                                                                                                              Function 002C8203 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C820A
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C8214
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • moneypunct.LIBCPMT ref: 002C824E
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C8265
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C8285
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C8292
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                                                                                              • String ID: `s5
                                                                                                                                                                                                                                              • API String ID: 3376033448-3845651492
                                                                                                                                                                                                                                              • Opcode ID: 823056c8b3f5025ddcec31e1c8377ddfd21c8d9a5d6efb559ece4d85f5da2236
                                                                                                                                                                                                                                              • Instruction ID: e03b2923db07dbdb042dd9d39f9b687a0727698e1c10243aac59859fa54a88c2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 823056c8b3f5025ddcec31e1c8377ddfd21c8d9a5d6efb559ece4d85f5da2236
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2B01AD369206599BCB05EBA4D819FAD7765BF84320F248A4DE8106B3D1DF709E148B91
                                                                                                                                                                                                                                              Function 002C8298 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C829F
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C82A9
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • moneypunct.LIBCPMT ref: 002C82E3
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C82FA
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C831A
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C8327
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                                                                                              • String ID: \s5
                                                                                                                                                                                                                                              • API String ID: 3376033448-3360088272
                                                                                                                                                                                                                                              • Opcode ID: 3dcc29423efe3191a8d4ee9adc5f53dc5c046c250105bd00d3a31286a993de73
                                                                                                                                                                                                                                              • Instruction ID: 12ad63f015174d562ea0839ac31f10a2bff11389ecf67bc0f88f613ff9b20fc7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3dcc29423efe3191a8d4ee9adc5f53dc5c046c250105bd00d3a31286a993de73
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D901A1359201599FCB06EB64D805EBEB7A5BF44724F28464DE810673E1DF709E14CF91
                                                                                                                                                                                                                                              Function 002C832D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C8334
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C833E
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • moneypunct.LIBCPMT ref: 002C8378
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C838F
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C83AF
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C83BC
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                                                                                              • String ID: 8s5
                                                                                                                                                                                                                                              • API String ID: 3376033448-2274919212
                                                                                                                                                                                                                                              • Opcode ID: 17d7de23ea233d64cad71fa3fda0457dde7f771d1c82d6fc9c8f53dad78f394a
                                                                                                                                                                                                                                              • Instruction ID: d8ba227bff47594a02df7c951b6a3f07aa1915d7feea955a2f6b420f283b69e3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 17d7de23ea233d64cad71fa3fda0457dde7f771d1c82d6fc9c8f53dad78f394a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9D01AD3A9202599BCB05EBA4C805BAE77A5AF84B20F25464DE8106B3D1DF709E159BD0
                                                                                                                                                                                                                                              Function 002C83C2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C83C9
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C83D3
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • moneypunct.LIBCPMT ref: 002C840D
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C8424
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C8444
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C8451
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                                                                                              • String ID: 4s5
                                                                                                                                                                                                                                              • API String ID: 3376033448-2390915656
                                                                                                                                                                                                                                              • Opcode ID: 36fafd0428320c155db4cbf6756d2a359ab8cdb9b371d0294877a84831ec3a95
                                                                                                                                                                                                                                              • Instruction ID: c56c434272484030ee54e60eeff36fc4d42b40ea4184829d40aa433381ea1e99
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 36fafd0428320c155db4cbf6756d2a359ab8cdb9b371d0294877a84831ec3a95
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3401C03592022A9BCB19EB64C805BAE7775BF84320F244A4DF8116B3D1DF709E159B91
                                                                                                                                                                                                                                              Function 002C8616 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C861D
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C8627
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • numpunct.LIBCPMT ref: 002C8661
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C8678
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C8698
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C86A5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registernumpunct
                                                                                                                                                                                                                                              • String ID: Hs5
                                                                                                                                                                                                                                              • API String ID: 3064348918-3546934140
                                                                                                                                                                                                                                              • Opcode ID: 3e32274c3e0e0646dacaa8e404a985cf3e21914b7342767f2a761d5776153c16
                                                                                                                                                                                                                                              • Instruction ID: da7e666bf39c8b985719c56353424878c80ebf561d85caf4138e25f1c670150e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3e32274c3e0e0646dacaa8e404a985cf3e21914b7342767f2a761d5776153c16
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8501C0359202199BCB05EFA4C809BADB77ABF84724F244A0DE8146B3D1DF709E54CF90
                                                                                                                                                                                                                                              Function 002C7CC6 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C7CCD
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C7CD7
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • collate.LIBCPMT ref: 002C7D11
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C7D28
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C7D48
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C7D55
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
                                                                                                                                                                                                                                              • String ID: Ls5
                                                                                                                                                                                                                                              • API String ID: 1767075461-3563078560
                                                                                                                                                                                                                                              • Opcode ID: 11678fe0992c6a3dd2eb2d54200357aab577bbcdf02116d4ecce626106e71f97
                                                                                                                                                                                                                                              • Instruction ID: ca2df1b4e330d58de9d7c5a00f6ae70d8b6d3a1556b5d1409d16010c60b93141
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 11678fe0992c6a3dd2eb2d54200357aab577bbcdf02116d4ecce626106e71f97
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B01AD369242199BCB06EB64D805BBDB7B6BF84320F24460DE8156B2E1DF709E158F90
                                                                                                                                                                                                                                              Function 002C7D5B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C7D62
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C7D6C
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • collate.LIBCPMT ref: 002C7DA6
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C7DBD
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C7DDD
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C7DEA
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
                                                                                                                                                                                                                                              • String ID: $s5
                                                                                                                                                                                                                                              • API String ID: 1767075461-2460277048
                                                                                                                                                                                                                                              • Opcode ID: bdcd825ab0f98c67b3a07fd0ffe6cef6bb26e7133d54e6438c5130ab9524a8d0
                                                                                                                                                                                                                                              • Instruction ID: 65b7d740bfc3ec1b4c301d15100e3adc5af6ae545395256908c3909eecfc6004
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bdcd825ab0f98c67b3a07fd0ffe6cef6bb26e7133d54e6438c5130ab9524a8d0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A801ED3592421A9BCB02EB64C805ABD7765BF80720F244A8DE8116B2D0DF309E15CF90
                                                                                                                                                                                                                                              Function 002C7E85 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C7E8C
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C7E96
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • messages.LIBCPMT ref: 002C7ED0
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C7EE7
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C7F07
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C7F14
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
                                                                                                                                                                                                                                              • String ID: Ps5
                                                                                                                                                                                                                                              • API String ID: 958335874-3244038580
                                                                                                                                                                                                                                              • Opcode ID: 99ec4a547c44d2d1170b98da008f7b5f6013e4721394b09830a76859531b471c
                                                                                                                                                                                                                                              • Instruction ID: 498691da9e907947625a406320a25c827b32647a6ec55931599ee1a3a3074eb1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99ec4a547c44d2d1170b98da008f7b5f6013e4721394b09830a76859531b471c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD01AD3A92421A9FCB06EB64D845ABE7765BF84320F244A4DF810AB3D1DF709E14CF90
                                                                                                                                                                                                                                              Function 002C7F1A Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C7F21
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C7F2B
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • messages.LIBCPMT ref: 002C7F65
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C7F7C
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C7F9C
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C7FA9
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
                                                                                                                                                                                                                                              • String ID: (s5
                                                                                                                                                                                                                                              • API String ID: 958335874-2612928604
                                                                                                                                                                                                                                              • Opcode ID: 1dd512ccf555ea60af30c234dbc427778b6218a5c548eecf12cba9920792df4c
                                                                                                                                                                                                                                              • Instruction ID: d01e5fc6f6115da2fec7835cc8d465e2a810b3f03ad93df63321a3ebb50fce23
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1dd512ccf555ea60af30c234dbc427778b6218a5c548eecf12cba9920792df4c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5E01C07992421A9BCB05EB64D845BAD7775BF84720F24460DF8106B3D1DF709E15CF90
                                                                                                                                                                                                                                              Function 002FA764 Relevance: 12.2, APIs: 8, Instructions: 203COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$___from_strstr_to_strchr
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3409252457-0
                                                                                                                                                                                                                                              • Opcode ID: 31ff8cdc1b2d34f577449439671fee83548517440c00f92c562c88ff99272ab4
                                                                                                                                                                                                                                              • Instruction ID: caf22ad7ea88c1f2c16ed0ec2822c868827fb1937abec3a52ae0a3a736236ba7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 31ff8cdc1b2d34f577449439671fee83548517440c00f92c562c88ff99272ab4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D85128F192430EAFDB11AFB49841E7DF7A8AF013D0F01817AE71997281EA718965CB52
                                                                                                                                                                                                                                              Function 00288690 Relevance: 12.2, APIs: 8, Instructions: 172COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002D987E: EnterCriticalSection.KERNEL32(003577A0,?,00000101,?,002886A7,00000000,?,00000101,?,00000000,?,?,0028C338,-00000010), ref: 002D9889
                                                                                                                                                                                                                                                • Part of subcall function 002D987E: LeaveCriticalSection.KERNEL32(003577A0,?,002886A7,00000000,?,00000101,?,00000000,?,?,0028C338,-00000010,?,?,?,1CE34B5F), ref: 002D98B5
                                                                                                                                                                                                                                              • FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000), ref: 002886D6
                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00000000,00000000), ref: 002886E4
                                                                                                                                                                                                                                              • LockResource.KERNEL32(00000000), ref: 002886EF
                                                                                                                                                                                                                                              • SizeofResource.KERNEL32(00000000,00000000), ref: 002886FD
                                                                                                                                                                                                                                              • FindResourceW.KERNEL32(00000000,?,00000006), ref: 00288764
                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00000000,00000000), ref: 00288776
                                                                                                                                                                                                                                              • LockResource.KERNEL32(00000000), ref: 00288785
                                                                                                                                                                                                                                              • SizeofResource.KERNEL32(00000000,00000000), ref: 00288797
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Resource$CriticalFindLoadLockSectionSizeof$EnterLeave
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 506522749-0
                                                                                                                                                                                                                                              • Opcode ID: 24183c824c01337c792ae32b7128156175538bcbda9800d01c44d9fe9968e9e9
                                                                                                                                                                                                                                              • Instruction ID: b688ba3774ecd5d4f4156b7dea986c421ccf506a29d0de3b454243a17cd0bd4a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 24183c824c01337c792ae32b7128156175538bcbda9800d01c44d9fe9968e9e9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1412639A112169BC721BF189884A7BB3E8EF98701F50492DFD56D7281FF31DC2487A2
                                                                                                                                                                                                                                              Function 002F087D Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                                • Part of subcall function 002F1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0B8A
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0BA3
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0BE1
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0BEA
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0BF6
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$ErrorLast
                                                                                                                                                                                                                                              • String ID: C
                                                                                                                                                                                                                                              • API String ID: 3291180501-1037565863
                                                                                                                                                                                                                                              • Opcode ID: 9cbeb97e38e5b7d18d92d844f28c6f6985b51a15a1413f8c3ca0021a90c92387
                                                                                                                                                                                                                                              • Instruction ID: b4e46c1de24094b803d963ea96f62a9a08cf6586d018be2f46d063e3c55e8b49
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9cbeb97e38e5b7d18d92d844f28c6f6985b51a15a1413f8c3ca0021a90c92387
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F2B13875A1121ADBDB24DF28C894AADF3B4FB18344F5045EAEA09A7351D770AEA0CF40
                                                                                                                                                                                                                                              Function 00281230 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • InitOnceBeginInitialize.KERNEL32(0035823C,00000000,?,00000000,?,?,?,?,00000000,00000000,?,1CE34B5F,?,?), ref: 0028125A
                                                                                                                                                                                                                                              • InitOnceComplete.KERNEL32(0035823C,00000000,00000000), ref: 00281278
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • McCryptoLib::CMcCryptoHMACWin::Initialize, xrefs: 002812EC, 002813D7
                                                                                                                                                                                                                                              • C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp, xrefs: 002812F3, 002813DE
                                                                                                                                                                                                                                              • [%S:(%d)][%S] Failed to create HMAC traits., xrefs: 002812F8
                                                                                                                                                                                                                                              • [%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls, xrefs: 002813E3
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitOnce$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID: C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp$McCryptoLib::CMcCryptoHMACWin::Initialize$[%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls$[%S:(%d)][%S] Failed to create HMAC traits.
                                                                                                                                                                                                                                              • API String ID: 51270584-3897904871
                                                                                                                                                                                                                                              • Opcode ID: f2d85d5f0bb304dc804e5c55dbe6a834adf5a696c1f16987ed1a75ea2b0551b1
                                                                                                                                                                                                                                              • Instruction ID: 26f5a3c6ea2a09e39fa893c1f6df033beea1b620406f251ddbc1b8aa1b4ab309
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2d85d5f0bb304dc804e5c55dbe6a834adf5a696c1f16987ed1a75ea2b0551b1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A51BE757103029BDB00EF28DC82FAE77A8BF98700F44452EF909972C1DA71E925CB92
                                                                                                                                                                                                                                              Function 002852D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 173COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: 0.0.0.0$UUID$UUID$Version$kernel32.dll
                                                                                                                                                                                                                                              • API String ID: 0-1483847951
                                                                                                                                                                                                                                              • Opcode ID: aa9d61eeed2523c07869cadcde046c8b9cccfbd29f99e038465edebcf3529276
                                                                                                                                                                                                                                              • Instruction ID: 6e4c76fed5648e5afc07edfa7b92b76dbb1e669228a2dae43efd3d685279d8c3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa9d61eeed2523c07869cadcde046c8b9cccfbd29f99e038465edebcf3529276
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2C819874916398CFEB25DFA8C8887DDBBB6AF48304F208219D414AB3D2D3784984CF51
                                                                                                                                                                                                                                              Function 002DBE00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 002DBE37
                                                                                                                                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 002DBE3F
                                                                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 002DBEC8
                                                                                                                                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 002DBEF3
                                                                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 002DBF48
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                                                                                                                                              • Opcode ID: 71b69584bb0ecaeeb3a5343d58a54a93429ab89f82773084ad5900e7a685d2cd
                                                                                                                                                                                                                                              • Instruction ID: 5c9370e19cc3f468f71ccf21be8dba7e9bbd4c3aebfec9c13c24ad938b825495
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 71b69584bb0ecaeeb3a5343d58a54a93429ab89f82773084ad5900e7a685d2cd
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DA41A234A20209DFCF12DF68C850A9EBBB5EF45314F15816AE9149B392D771AD25CF90
                                                                                                                                                                                                                                              Function 0028C960 Relevance: 10.6, APIs: 7, Instructions: 116COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0028C995
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0028C9B7
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0028C9D7
                                                                                                                                                                                                                                              • __Getctype.LIBCPMT ref: 0028CA70
                                                                                                                                                                                                                                              • std::_Locinfo::~_Locinfo.LIBCPMT ref: 0028CA82
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 0028CA8F
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0028CAB1
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfoLocinfo::~_Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3947131827-0
                                                                                                                                                                                                                                              • Opcode ID: 4a4c2d03696abdc8557076ace7a03df946955f0eb4dd4033428860c14c49d384
                                                                                                                                                                                                                                              • Instruction ID: c2e903c3778abe4a012c4111d5ebd73ff86d526511395f279f4a45e20f1d6aa7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a4c2d03696abdc8557076ace7a03df946955f0eb4dd4033428860c14c49d384
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E41E2759112498FCB15EF54D841BAEB7B8FF44310F24855DE81AAB391DB30AE25CB90
                                                                                                                                                                                                                                              Function 0027A550 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,1CE34B5F,?,?), ref: 0027A531
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 0027A58B
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027A989
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 0027A99D
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Thread signalled when event queue is empty, xrefs: 0027A614
                                                                                                                                                                                                                                              • Unexpected return value: , xrefs: 0027A8CC
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitIos_base_dtorMtx_unlockOncestd::ios_base::_$BeginCompleteInitializeMultipleObjectsWait
                                                                                                                                                                                                                                              • String ID: Thread signalled when event queue is empty$Unexpected return value:
                                                                                                                                                                                                                                              • API String ID: 3324347728-3645029203
                                                                                                                                                                                                                                              • Opcode ID: e0a3e0fd3cac2b0c7019dce6d14367ae9880241591de29e4e8e242ad6e0e98b2
                                                                                                                                                                                                                                              • Instruction ID: bebc49d2be5408cc68436913ed6d806c88b53a9569304594be6403ef06a82a32
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e0a3e0fd3cac2b0c7019dce6d14367ae9880241591de29e4e8e242ad6e0e98b2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C041B0B0D21218DADF15DFA0CC49BDDB779AF50324F508298E409A72C1EB706BA9CF52
                                                                                                                                                                                                                                              Function 002F416A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                              • API String ID: 0-537541572
                                                                                                                                                                                                                                              • Opcode ID: 3a1db269ab86453c69f0a0f70adc61b6ab72d0efba5941b19940c7fa67b31b87
                                                                                                                                                                                                                                              • Instruction ID: 82d6dd941b2b78e814844cdcf4c6ecace12a58430148a3c317cd9e4fead62b6a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3a1db269ab86453c69f0a0f70adc61b6ab72d0efba5941b19940c7fa67b31b87
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5E210871A2122AABD722AF249C40A7BB7589B557E0F110270FE15A7290D6F0ED20C5E0
                                                                                                                                                                                                                                              Function 002FB9B3 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002FB6FF: _free.LIBCMT ref: 002FB724
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBA01
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: RtlFreeHeap.NTDLL(00000000,00000000,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?), ref: 002F20AE
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: GetLastError.KERNEL32(?,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?,?), ref: 002F20C0
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBA0C
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBA17
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBA6B
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBA76
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBA81
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FBA8C
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 776569668-0
                                                                                                                                                                                                                                              • Opcode ID: c22744a6882dbffdb4525d9527ade6ae6b6bf27445b1f441715d8059192af9a9
                                                                                                                                                                                                                                              • Instruction ID: ad17bb32b1c16edea2c53a60328de7bc2147ad9888932a2c38dfb9057dbb4a00
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c22744a6882dbffdb4525d9527ade6ae6b6bf27445b1f441715d8059192af9a9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 74116072551B0CE6D531BB71CC0BFEBF79C5F11780F400838B3AEA6252EB64A5298A50
                                                                                                                                                                                                                                              Function 002C8044 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C804B
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C8055
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C80A6
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C80C6
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C80D3
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: ,s5
                                                                                                                                                                                                                                              • API String ID: 55977855-2629273728
                                                                                                                                                                                                                                              • Opcode ID: a1b5e70e7338cfba89ccfbec3d151e013156f7ccd3f27a1f69a05cc4ee234eed
                                                                                                                                                                                                                                              • Instruction ID: aaba7a4a51fe3252f73e7a94f24d585492c6639fcfc48c0eb4965e67084b0788
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1b5e70e7338cfba89ccfbec3d151e013156f7ccd3f27a1f69a05cc4ee234eed
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F001ED359202199BCB06EB64D805FAEB765BF44720F24460DE8106B2D1DF709E588F90
                                                                                                                                                                                                                                              Function 002C80D9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C80E0
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C80EA
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C813B
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C815B
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C8168
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: Xs5
                                                                                                                                                                                                                                              • API String ID: 55977855-3478079500
                                                                                                                                                                                                                                              • Opcode ID: 0b27e6babed01a8498d9f927afcb0f5b2ac15b14ef24a611227711c136e9df29
                                                                                                                                                                                                                                              • Instruction ID: d17ee8a5d25b80e038ee039ae1f62c72f5f0c91a6d6aa53a42473bd35798dd96
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0b27e6babed01a8498d9f927afcb0f5b2ac15b14ef24a611227711c136e9df29
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D10104359202199FCB02EB64C805BAE77B5BF40720F284A0DE810673D0CF709E15CF80
                                                                                                                                                                                                                                              Function 002C816E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C8175
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C817F
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C81D0
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C81F0
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C81FD
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: 0s5
                                                                                                                                                                                                                                              • API String ID: 55977855-2307642004
                                                                                                                                                                                                                                              • Opcode ID: 92276e9821e6cf54a28a7382c93aba8c019616f756eeab82f7053e7b09958ae2
                                                                                                                                                                                                                                              • Instruction ID: eb65f6e1c16ebd29318ea4cb92717776d7efe410e963b6bfbfad832524aa7ba9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 92276e9821e6cf54a28a7382c93aba8c019616f756eeab82f7053e7b09958ae2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1601A1369202559BCB05EB64C805AAD77B5BF44321F28460DE814673D1DFB09E158F90
                                                                                                                                                                                                                                              Function 002C8457 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C845E
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C8468
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C84B9
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C84D9
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C84E6
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: @s5
                                                                                                                                                                                                                                              • API String ID: 55977855-3715807940
                                                                                                                                                                                                                                              • Opcode ID: ee01baf0627aaef8915a84300fb18a33dab8846ae99a16d77c6e87d549a8d246
                                                                                                                                                                                                                                              • Instruction ID: 9d3f9d43b744433a50faef0adf32f9cbf5d930bf8e06fa5298bb64d0800f8c03
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee01baf0627aaef8915a84300fb18a33dab8846ae99a16d77c6e87d549a8d246
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2901A13592021A9BCB15EF64C805AAE7775BF44720F244A4DF810672D1DF709E15CB90
                                                                                                                                                                                                                                              Function 002C84EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C84F3
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C84FD
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C854E
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C856E
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C857B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: s5
                                                                                                                                                                                                                                              • API String ID: 55977855-2511172068
                                                                                                                                                                                                                                              • Opcode ID: a08001ca5c90943e1e7b5a911a2306e52d22dec12d827904b0d471bd40bd0b9c
                                                                                                                                                                                                                                              • Instruction ID: a372f98236e857cbf6ac5405175af00e2b727fceec4b44121580f4dd190cc587
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a08001ca5c90943e1e7b5a911a2306e52d22dec12d827904b0d471bd40bd0b9c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CE0100369202199BCB01EB64D805BAEB7B5BF40320F258A0DE810AB3E1DF709E148FC1
                                                                                                                                                                                                                                              Function 002C8581 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C8588
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C8592
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C85E3
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C8603
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C8610
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: Ds5
                                                                                                                                                                                                                                              • API String ID: 55977855-3664974360
                                                                                                                                                                                                                                              • Opcode ID: 42fbc4f9a649791b17cf19efb4966dcac2a182c4585001f97e954c1536368326
                                                                                                                                                                                                                                              • Instruction ID: d808f39b208a0189a8b3a01d45d47c13e2158e6a781a3343d697e544ab6b3ec8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42fbc4f9a649791b17cf19efb4966dcac2a182c4585001f97e954c1536368326
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0001C0369202199BCB05EF64C805BAEB779BF44720F244A4DE8106B3D1DF709E148FD5
                                                                                                                                                                                                                                              Function 002C86AB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C86B2
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C86BC
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C870D
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C872D
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C873A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: ds5
                                                                                                                                                                                                                                              • API String ID: 55977855-3795735800
                                                                                                                                                                                                                                              • Opcode ID: efaae0eb6b2ec19d73b85207702f6624242fc797b92d8c4a5f9e2e7505cb0541
                                                                                                                                                                                                                                              • Instruction ID: ff2b9a84582ba3d30a3b8d870382d82062ce6aa0c71ca8d5979dbb446a9e82da
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: efaae0eb6b2ec19d73b85207702f6624242fc797b92d8c4a5f9e2e7505cb0541
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A301C03A92021ADBCB06EB64C815BADB775BF44320F24464DE8106B3D1EF709E258B91
                                                                                                                                                                                                                                              Function 002C8740 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C8747
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C8751
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C87A2
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C87C2
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C87CF
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: <s5
                                                                                                                                                                                                                                              • API String ID: 55977855-2156997616
                                                                                                                                                                                                                                              • Opcode ID: 1eeee6062dafa8feb84cfa4d8dbdecb6ac420c8edaef64cf8922935b1f92cd10
                                                                                                                                                                                                                                              • Instruction ID: ec196a22662e2f0c26a5d3457c1c19a01362ba3e184a5fe9b157b3d677f3b72b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1eeee6062dafa8feb84cfa4d8dbdecb6ac420c8edaef64cf8922935b1f92cd10
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 52016D399202199BCB05EB64D845ABEB766BF44724F244A0DE8106B2D1EF709E689B90
                                                                                                                                                                                                                                              Function 002C87D5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C87DC
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C87E6
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C8837
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C8857
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C8864
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: hs5
                                                                                                                                                                                                                                              • API String ID: 55977855-3945049500
                                                                                                                                                                                                                                              • Opcode ID: c4e96060699e374c2473542b435b0ec5a372ae91d9c512094cf47603a7a65562
                                                                                                                                                                                                                                              • Instruction ID: 6de40782551f2a59b0d22fc21282b17d582b5ec79bbf338e048ba1ed42ef0cf5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c4e96060699e374c2473542b435b0ec5a372ae91d9c512094cf47603a7a65562
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D701C03592021A9BCB05EB64D805FAE77B6BF44724F248A0DE8106B3D1DF709E64DBD0
                                                                                                                                                                                                                                              Function 002C7FAF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C7FB6
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C7FC0
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C8011
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C8031
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C803E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID: Ts5
                                                                                                                                                                                                                                              • API String ID: 55977855-3327504744
                                                                                                                                                                                                                                              • Opcode ID: 58596805e0015d07f4a8efaefbf0963d6dc5c46cd767fb462c67b29b79160322
                                                                                                                                                                                                                                              • Instruction ID: b67ddadd4486a63a84be5799f49ee0f73904e812fc48d8b4c024840ad2eb8b7f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 58596805e0015d07f4a8efaefbf0963d6dc5c46cd767fb462c67b29b79160322
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6801E1399201198FCB06EB64C805BAD7765BF44320F24460DE8106B3D1DFB09E148B80
                                                                                                                                                                                                                                              Function 002D88B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0035742C,?,?,00274086,0035827C,003168E0,?), ref: 002D88BA
                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0035742C,?,?,00274086,0035827C,003168E0,?), ref: 002D88ED
                                                                                                                                                                                                                                              • RtlWakeAllConditionVariable.NTDLL ref: 002D8964
                                                                                                                                                                                                                                              • SetEvent.KERNEL32(?,00274086,0035827C,003168E0,?), ref: 002D896E
                                                                                                                                                                                                                                              • ResetEvent.KERNEL32(?,00274086,0035827C,003168E0,?), ref: 002D897A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
                                                                                                                                                                                                                                              • String ID: ,t5
                                                                                                                                                                                                                                              • API String ID: 3916383385-3556122183
                                                                                                                                                                                                                                              • Opcode ID: 113aea6c1fa411806bd14dac294c0414d36896ac41ff5e2bf9db513ccb5a771e
                                                                                                                                                                                                                                              • Instruction ID: 05f8672e98697ac3317c0ed176976002897733e5ce9658265f1c151dd9c1f599
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 113aea6c1fa411806bd14dac294c0414d36896ac41ff5e2bf9db513ccb5a771e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7F01F6B5514260DFC706AF29FC589D97BADEB0D712F05806AED0197331CB756C11CB91
                                                                                                                                                                                                                                              Function 002F576D Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetConsoleCP.KERNEL32(?,0029860A,00000000), ref: 002F57B5
                                                                                                                                                                                                                                              • __fassign.LIBCMT ref: 002F5994
                                                                                                                                                                                                                                              • __fassign.LIBCMT ref: 002F59B1
                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,0029860A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002F59F9
                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 002F5A39
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 002F5AE5
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileWrite__fassign$ConsoleErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4031098158-0
                                                                                                                                                                                                                                              • Opcode ID: e355451e6fd59877e6abab5cde662f7006386665902a16de714338c3bfccae3f
                                                                                                                                                                                                                                              • Instruction ID: 279b01c5d54243834b75bde87d9d99b9afa0f3ef0b58c7bd853ccfd22106d0be
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e355451e6fd59877e6abab5cde662f7006386665902a16de714338c3bfccae3f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 12D1BA71D1066D9FCB15CFA8C8809EDFBB5AF08354F28016AEA55FB241D230AD66CF50
                                                                                                                                                                                                                                              Function 002D809D Relevance: 9.2, APIs: 6, Instructions: 224COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCPInfo.KERNEL32(?,?), ref: 002D8128
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 002D81B6
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 002D8228
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 002D8242
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 002D82A5
                                                                                                                                                                                                                                              • CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 002D82C2
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$CompareInfoString
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2984826149-0
                                                                                                                                                                                                                                              • Opcode ID: 62999aab39044f47920f1416ffe7ff64bbd493ccf8542bd1f946dba9cf8ea93c
                                                                                                                                                                                                                                              • Instruction ID: 8256fb6adcf340d2209f9e8f97ccbf164c53f7699ac90db05514c01c2d6c8846
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 62999aab39044f47920f1416ffe7ff64bbd493ccf8542bd1f946dba9cf8ea93c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B771927292068AAEDF219FA5CC45AEF7BBAEF49310F244117E805A6350DF35CC25CB60
                                                                                                                                                                                                                                              Function 002C68B8 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 002C6901
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 002C696C
                                                                                                                                                                                                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C6989
                                                                                                                                                                                                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 002C69C8
                                                                                                                                                                                                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C6A27
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 002C6A4A
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiStringWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2829165498-0
                                                                                                                                                                                                                                              • Opcode ID: 514e274d72dc263532b5bd67972a12610c0b9a5111f99d3db9f93cb76a1f29cf
                                                                                                                                                                                                                                              • Instruction ID: f4382a23981350ebbc3c09fdd705c251b1ed81351865aebd9a3c2153b13472e7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 514e274d72dc263532b5bd67972a12610c0b9a5111f99d3db9f93cb76a1f29cf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7851D07292021AAFEF209F64CC49FAB3BB9EF44750F148629FD04A6150E731CD20CB60
                                                                                                                                                                                                                                              Function 0028DF80 Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,1CE34B5F), ref: 0028E00F
                                                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,00000014,00000001,?,?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0028E073
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,00000001), ref: 0028E104
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00000001,?,?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0028E112
                                                                                                                                                                                                                                              • FreeSid.ADVAPI32(00000000,00000001,?,?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0028E11D
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FreeLocal$AllocErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3195132385-0
                                                                                                                                                                                                                                              • Opcode ID: 16ffb77d0af4b8cc436050eec6df2257d5f5c8a8dfeabbe5ff5023f382db60ed
                                                                                                                                                                                                                                              • Instruction ID: ea797f2e8ab01be49a7b11d11da3f663392b8b71feefdd028be416514b830fc4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 16ffb77d0af4b8cc436050eec6df2257d5f5c8a8dfeabbe5ff5023f382db60ed
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5A513875E11219AFEF00DFA4C885BEEBBB8EF08710F10412AE905B7381D77599148BA0
                                                                                                                                                                                                                                              Function 0026E790 Relevance: 9.1, APIs: 6, Instructions: 130COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000001,?,00000000), ref: 0026E7D7
                                                                                                                                                                                                                                              • GetSecurityDescriptorDacl.ADVAPI32(00000000,00000000,00000000,?), ref: 0026E811
                                                                                                                                                                                                                                              • SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000004,00000000,00000000,00000000,00000000,?), ref: 0026E86D
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000), ref: 0026E8C7
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000), ref: 0026E8DC
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000), ref: 0026E917
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Security$DescriptorFreeLocal$ConvertDaclInfoNamedString
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2792426717-0
                                                                                                                                                                                                                                              • Opcode ID: ffc843fb594340f902ba64ca20274d4b066915f71ddbde5a3dcfa9aaeafe2977
                                                                                                                                                                                                                                              • Instruction ID: 9cf57497391575c9633bfccb727d0ca99b0421f4402b68d48cc49b9e17d6079f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ffc843fb594340f902ba64ca20274d4b066915f71ddbde5a3dcfa9aaeafe2977
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B641A074D11209ABEF11DFA4DD49BDEB7B8FF08700F204129F810A3290D7799A44CBA0
                                                                                                                                                                                                                                              Function 00268D10 Relevance: 9.1, APIs: 6, Instructions: 128COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00268D46
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00268D66
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00268D86
                                                                                                                                                                                                                                              • std::_Locinfo::~_Locinfo.LIBCPMT ref: 00268E57
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 00268E64
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00268E86
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2966223926-0
                                                                                                                                                                                                                                              • Opcode ID: e72f3e52d5eae99d3503e8830301e7b837a59adc179efe92592001c0a7792868
                                                                                                                                                                                                                                              • Instruction ID: ec0f0671e8e43ddc5616800047d440951997b3bb6bec803b4a7465f891c0f525
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e72f3e52d5eae99d3503e8830301e7b837a59adc179efe92592001c0a7792868
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E41FE71910245DFCB12EF64C881BAEBBB8FF50310F144659E806AB291DF31AE65CB91
                                                                                                                                                                                                                                              Function 002E3207 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __freea
                                                                                                                                                                                                                                              • String ID: 3A.$a/p$am/pm
                                                                                                                                                                                                                                              • API String ID: 240046367-3581238652
                                                                                                                                                                                                                                              • Opcode ID: 02e13c30d610ade58e8fa794f0635f27dfe32d82b8769482a60aacb0f5c6452b
                                                                                                                                                                                                                                              • Instruction ID: d36fb2af50bf7d55bf25701a53da538b6c01226c8ed7e0a63e0eb22997b925a5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 02e13c30d610ade58e8fa794f0635f27dfe32d82b8769482a60aacb0f5c6452b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BCC115319B0286DBCB24CF6AC88DABAB7B4FF09702F944149E501AB350D7718F61CB95
                                                                                                                                                                                                                                              Function 00273400 Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00273435
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00273457
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00273477
                                                                                                                                                                                                                                              • std::_Locinfo::~_Locinfo.LIBCPMT ref: 0027353A
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 00273547
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00273569
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2966223926-0
                                                                                                                                                                                                                                              • Opcode ID: 43d422e0ee8ca089534c2285a737ff25f626818dd1b33707d856f7ab4e88e7fb
                                                                                                                                                                                                                                              • Instruction ID: 9503415d7e0f5102617a2eaebada0b75a20a067f6d8409a1d1e9c9c30cebf00d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 43d422e0ee8ca089534c2285a737ff25f626818dd1b33707d856f7ab4e88e7fb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7941DD71910246DFCB06DF58C851BAEB7B4FF54314F148299E809AB362EB34EA65CB80
                                                                                                                                                                                                                                              Function 002632DE Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002632E5
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002632F2
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 00263340
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00263360
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0026336D
                                                                                                                                                                                                                                              • __Towlower.LIBCPMT ref: 00263388
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_RegisterTowlower
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2111902878-0
                                                                                                                                                                                                                                              • Opcode ID: 833fae6fe38ce989b4b05ec73b4fbd0688994209bc0ce792d36b59c6aa1c517c
                                                                                                                                                                                                                                              • Instruction ID: 63b9a8b6252e2e7742b6757ac2ddb3f2385843a8dc8ff6a21df9ed6dc3e79e00
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 833fae6fe38ce989b4b05ec73b4fbd0688994209bc0ce792d36b59c6aa1c517c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 041102369201099FCB05EB64D441AAEB7A8AF84710F24454AF905A73D1CF309FA5CF91
                                                                                                                                                                                                                                              Function 002DBFCA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,002DBFC1,002DA1CC,002D95E4), ref: 002DBFD8
                                                                                                                                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002DBFE6
                                                                                                                                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002DBFFF
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,002DBFC1,002DA1CC,002D95E4), ref: 002DC051
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3852720340-0
                                                                                                                                                                                                                                              • Opcode ID: fc06b9fbb514861a7018d139bea58fccc551ef9cc6086a38e590636364e0f700
                                                                                                                                                                                                                                              • Instruction ID: c7877a8c790ce2f362b5f010218c9523bb8ecda4cdb2ced72c33e310cad4a2c8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc06b9fbb514861a7018d139bea58fccc551ef9cc6086a38e590636364e0f700
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C301F13223C713AEA6262AB4BC8556A2A48EF43776B31023BF610682F4EE556C209940
                                                                                                                                                                                                                                              Function 002C435B Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C4362
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C436C
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • codecvt.LIBCPMT ref: 002C43A6
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C43BD
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C43DD
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C43EA
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2133458128-0
                                                                                                                                                                                                                                              • Opcode ID: c38c4d1c0b607fb63e280519746c1aac62c6c0fb53c838c6d915c9cb672764d1
                                                                                                                                                                                                                                              • Instruction ID: dd39144b1e0dfa93f71bcc7e777e8928c47f4e5c571e969996eee2bd0790a78e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c38c4d1c0b607fb63e280519746c1aac62c6c0fb53c838c6d915c9cb672764d1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7201CB3592025A8BCB05FB648821BAE77B6BF80710F244A49F8106B2D0CF708E248B80
                                                                                                                                                                                                                                              Function 002D4475 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D447C
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D4486
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • collate.LIBCPMT ref: 002D44C0
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D44D7
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D44F7
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D4504
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1767075461-0
                                                                                                                                                                                                                                              • Opcode ID: d8748bfab7aa57fcfc67148a5d74fdee9712a7da800b41facb641c7b27c76df4
                                                                                                                                                                                                                                              • Instruction ID: ef4e96750693eae956b8c7eceb432e09ff7515125dadc36693a95728f789a311
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d8748bfab7aa57fcfc67148a5d74fdee9712a7da800b41facb641c7b27c76df4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CD01D23A92021A9BCB05FBA4D855BAD7775BF84320F24494AF8106B3D2DF709E54CF90
                                                                                                                                                                                                                                              Function 002D450A Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D4511
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D451B
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • messages.LIBCPMT ref: 002D4555
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D456C
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D458C
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D4599
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 958335874-0
                                                                                                                                                                                                                                              • Opcode ID: 1c66f2da608b395b350267ac3970181f162f976645d58655ecd1adb36bf8ff65
                                                                                                                                                                                                                                              • Instruction ID: 46d5e7f15fab0d6308b8a48414624408088aaee0728d7675323378a656f9cf4c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c66f2da608b395b350267ac3970181f162f976645d58655ecd1adb36bf8ff65
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C01D23992021A9BCB05FB64D855ABE7779BF54320F24094AF8106B3D1DF709E24CF90
                                                                                                                                                                                                                                              Function 002D46C9 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D46D0
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D46DA
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • moneypunct.LIBCPMT ref: 002D4714
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D472B
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D474B
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D4758
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3376033448-0
                                                                                                                                                                                                                                              • Opcode ID: 8fbee8f61df418b53174c2b2082ad4c0efc8c8edf69238f7731d497dc4eee30d
                                                                                                                                                                                                                                              • Instruction ID: 781f3b903e814a9bedc4f1287fdd188b4216cd0e544a0717fcd9e41e678f2638
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8fbee8f61df418b53174c2b2082ad4c0efc8c8edf69238f7731d497dc4eee30d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5B01C03992021A9BCB05FB64C805ABEB7B5BF45320F25054AF8206B3D1DF749E25CF90
                                                                                                                                                                                                                                              Function 002D475E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D4765
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D476F
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • moneypunct.LIBCPMT ref: 002D47A9
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D47C0
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D47E0
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D47ED
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3376033448-0
                                                                                                                                                                                                                                              • Opcode ID: b10a4e45189af619571b03bb6d4330f5339074a0667304f444ad9d71a83def39
                                                                                                                                                                                                                                              • Instruction ID: 8cede2e6577c6657bf51a742f763dace034c3d7d0f530daf99fa5c73c972f3c7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b10a4e45189af619571b03bb6d4330f5339074a0667304f444ad9d71a83def39
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4D01003992021A8BCB01FF64D805AADB775BF80324F24090AF8106B3D1CF709E24CB80
                                                                                                                                                                                                                                              Function 002C7DF0 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C7DF7
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C7E01
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • ctype.LIBCPMT ref: 002C7E3B
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C7E52
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C7E72
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C7E7F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2958136301-0
                                                                                                                                                                                                                                              • Opcode ID: cbe8a718a777df2ae8c329a15ec4564609d0103a6d02f409d90117d332883047
                                                                                                                                                                                                                                              • Instruction ID: 5e7c1c95b67f71fdacd92fc6ff0236cdf8ad249bd63d8ae0924380d91f2cfe17
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cbe8a718a777df2ae8c329a15ec4564609d0103a6d02f409d90117d332883047
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C201C0369242199BCB05EB64D805BAEB7B5BF84320F24468DE8106B3E1DF709E25CF90
                                                                                                                                                                                                                                              Function 0028C410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0028C546
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0028C54B
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0028C550
                                                                                                                                                                                                                                                • Part of subcall function 002DE960: _free.LIBCMT ref: 002DE973
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_task$_free
                                                                                                                                                                                                                                              • String ID: false$true
                                                                                                                                                                                                                                              • API String ID: 149343396-2658103896
                                                                                                                                                                                                                                              • Opcode ID: 5b8742dd1a9e5df710fc8afa2a8a7175f77e46dca371c94b2b4cdc4c7748082f
                                                                                                                                                                                                                                              • Instruction ID: 054645d340493e689e1057a26a52b38c1203dd90560268ec9ae2d926f42e37c0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b8742dd1a9e5df710fc8afa2a8a7175f77e46dca371c94b2b4cdc4c7748082f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8C4179799113809FCB20EF64D841BAABBF4EF05300F14855DE846AB392D776E918CFA0
                                                                                                                                                                                                                                              Function 002CDDD2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Mpunct$GetvalsH_prolog3
                                                                                                                                                                                                                                              • String ID: $+xv
                                                                                                                                                                                                                                              • API String ID: 2204710431-1686923651
                                                                                                                                                                                                                                              • Opcode ID: 62b7bdf5ffb458c8cd2918793d10c09f897ab454d3525e012f4685c333779bcf
                                                                                                                                                                                                                                              • Instruction ID: 1d8b5ef72ac83dcc988730c5ce1d2c85f3fe9fac9603ece77e33b22be9ebf8b5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 62b7bdf5ffb458c8cd2918793d10c09f897ab454d3525e012f4685c333779bcf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 132181A1914A926FDB21DF748890B7BBEF8AB18700B040A5EE459C7A41D730EA21CF90
                                                                                                                                                                                                                                              Function 002E5FF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetStdHandle.KERNEL32(000000F4,?,?), ref: 002E6016
                                                                                                                                                                                                                                              • GetFileType.KERNEL32(00000000), ref: 002E6028
                                                                                                                                                                                                                                              • swprintf.LIBCMT ref: 002E6049
                                                                                                                                                                                                                                              • WriteConsoleW.KERNEL32(00000000,?,?,?,00000000), ref: 002E6086
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Assertion failed: %Ts, file %Ts, line %d, xrefs: 002E603E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleFileHandleTypeWriteswprintf
                                                                                                                                                                                                                                              • String ID: Assertion failed: %Ts, file %Ts, line %d
                                                                                                                                                                                                                                              • API String ID: 2943507729-1719349581
                                                                                                                                                                                                                                              • Opcode ID: a1717b2abe1360ce8af51814bcca011c61bee026c566c6b61397ebc152a686c4
                                                                                                                                                                                                                                              • Instruction ID: 0da57cca7b7fc51d0f4e8c7fc32445244259bb5445f5d0b9b349eceeb4bae414
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1717b2abe1360ce8af51814bcca011c61bee026c566c6b61397ebc152a686c4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57115B755001296BCB20AF2ACC49BEF73ADEFA4310F80465CFD1A93180DA30BE518B64
                                                                                                                                                                                                                                              Function 002DD1B7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,002DD278,?,?,003577FC,00000000,?,002DD3A3,00000004,InitializeCriticalSectionEx,0033013C,00330144,00000000), ref: 002DD247
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                              • API String ID: 3664257935-2084034818
                                                                                                                                                                                                                                              • Opcode ID: c3d7212bb8a662250926cf78a39deb8b058312989584e7ed2ea022b0edc0b3c2
                                                                                                                                                                                                                                              • Instruction ID: f5ba4966e029abfb9e74c545592d6e37908f9d33b63e1d43da5d5a449cb1876d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c3d7212bb8a662250926cf78a39deb8b058312989584e7ed2ea022b0edc0b3c2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 13110631A10A22ABCB228F68EC88B5977A8AF05770F104162FD41E73C1D7B0ED108AD0
                                                                                                                                                                                                                                              Function 0028E150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registrylibraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 0028E172
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0028E182
                                                                                                                                                                                                                                              • RegDeleteKeyW.ADVAPI32(00000000,?), ref: 0028E1C2
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressDeleteHandleModuleProc
                                                                                                                                                                                                                                              • String ID: Advapi32.dll$RegDeleteKeyExW
                                                                                                                                                                                                                                              • API String ID: 588496660-2191092095
                                                                                                                                                                                                                                              • Opcode ID: 5403830d4f9eed871cd4950f4497e70c12463ed725c9de966e509b4ac9040725
                                                                                                                                                                                                                                              • Instruction ID: c97a15f7df81a3f6897f4866872c9102aa9d4e86e89af77c140b1251944fa941
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5403830d4f9eed871cd4950f4497e70c12463ed725c9de966e509b4ac9040725
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7201DD392153409AD7235B5AFD0AB967BADE794712F048036F508D31F0C3F29860DB60
                                                                                                                                                                                                                                              Function 0028F980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,1CE34B5F), ref: 0028F989
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0028F9A9
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                              • String ID: IsWow64Process$kernel32
                                                                                                                                                                                                                                              • API String ID: 1646373207-3789238822
                                                                                                                                                                                                                                              • Opcode ID: dcdd3f8d71fb7d3e21a4d296b18fdc4d0daf1e0d463e437cc1b5c3b20ab00def
                                                                                                                                                                                                                                              • Instruction ID: ea428724bbb4b8ed10516b9711b27dcd2c2a660b649f3416f41a4151b11e9359
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dcdd3f8d71fb7d3e21a4d296b18fdc4d0daf1e0d463e437cc1b5c3b20ab00def
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23F0A472901319AFC712DF95DD05B9A7BACEB19351F0081A6FC04C7280D6719D10CBE1
                                                                                                                                                                                                                                              Function 002B11F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002B1210
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002B121A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 002B122D
                                                                                                                                                                                                                                              • WriteFile failed: %d, xrefs: 002B1221
                                                                                                                                                                                                                                              • NWebAdvisor::CCabParser::Write, xrefs: 002B1228
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                              • String ID: NWebAdvisor::CCabParser::Write$WriteFile failed: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
                                                                                                                                                                                                                                              • API String ID: 442123175-2264278858
                                                                                                                                                                                                                                              • Opcode ID: 4925e30964d5ddc465965c01aa28d009b519caae331ba4613bf7f8d687ace0cb
                                                                                                                                                                                                                                              • Instruction ID: a360f2dd1d8179f7524de470c4d81ea8584e8a36170a767c6649480dae7fdea9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4925e30964d5ddc465965c01aa28d009b519caae331ba4613bf7f8d687ace0cb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78F0A431700108BFDB40EF64EC03FADB7A8EB18B04F404069FD099A181D9719E24DB50
                                                                                                                                                                                                                                              Function 002908A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32), ref: 002908A9
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 002908C0
                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?), ref: 002908D7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressCurrentHandleModuleProcProcess
                                                                                                                                                                                                                                              • String ID: IsWow64Process$kernel32
                                                                                                                                                                                                                                              • API String ID: 4190356694-3789238822
                                                                                                                                                                                                                                              • Opcode ID: 492912679844e1de0ca06cd32a8ceaf318de85afb0d175148c8df595ff0bf8be
                                                                                                                                                                                                                                              • Instruction ID: 3fa285efe73c292267b5bfb434d979857ae178d4b359b74af374044f96634da4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 492912679844e1de0ca06cd32a8ceaf318de85afb0d175148c8df595ff0bf8be
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CDF0A732E5532DAFDE119FE16C49AEA779CEF09755F0045D5EC0893240E6728D1496D0
                                                                                                                                                                                                                                              Function 002EE940 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,002EE935,?,?,002EE8FD,00000002,00000002,?), ref: 002EE955
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 002EE968
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,002EE935,?,?,002EE8FD,00000002,00000002,?), ref: 002EE98B
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                              • Opcode ID: ed01b06f2ad99d0df84867d81c582fd6a3de8bdc9a5143145fc3f9da0b99dd0c
                                                                                                                                                                                                                                              • Instruction ID: c3401e025dc9f055e70043ceae7b5bb114c39d28c1cdde0fab3ee9bc61600b24
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ed01b06f2ad99d0df84867d81c582fd6a3de8bdc9a5143145fc3f9da0b99dd0c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8F08C30A60219FBDF129B92DD09FDDBAB8EB08B55F0540A0F804A21A0CBB18E00DA90
                                                                                                                                                                                                                                              Function 002D8982 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SleepConditionVariableCS.KERNELBASE(?,002D891F,00000064), ref: 002D89A5
                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(0035742C,00271171,?,002D891F,00000064,?,?,?,0027402B,0035827C,1CE34B5F,?,00271171,?), ref: 002D89AF
                                                                                                                                                                                                                                              • WaitForSingleObjectEx.KERNEL32(00271171,00000000,?,002D891F,00000064,?,?,?,0027402B,0035827C,1CE34B5F,?,00271171,?), ref: 002D89C0
                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(0035742C,?,002D891F,00000064,?,?,?,0027402B,0035827C,1CE34B5F,?,00271171,?), ref: 002D89C7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                                                                              • String ID: ,t5
                                                                                                                                                                                                                                              • API String ID: 3269011525-3556122183
                                                                                                                                                                                                                                              • Opcode ID: 1f8d2cd7fd2c52d77c7325b31100c71a0b183545f1bc6f7355dca23369aca07d
                                                                                                                                                                                                                                              • Instruction ID: 1f66e8e1a7e3abee583c9fa8a8a9ce41cc851ae6e6ecc75642efa8ea4133035d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f8d2cd7fd2c52d77c7325b31100c71a0b183545f1bc6f7355dca23369aca07d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 82E0ED76559224ABC7132B56FC08DDD7E2DEB0CB52F048461FD4556271CA7218209BD6
                                                                                                                                                                                                                                              Function 002F03F2 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002F2174: RtlAllocateHeap.NTDLL(00000000,?,?,?,002D872D,?,?,0026A1ED,0000002C,1CE34B5F), ref: 002F21A6
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0501
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0518
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0535
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0550
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F0567
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$AllocateHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3033488037-0
                                                                                                                                                                                                                                              • Opcode ID: ca1b4104bbfcdd50b8d2216b283b4f3ab9d971a098f59625fc6459ac956e6054
                                                                                                                                                                                                                                              • Instruction ID: 6eb7dec2f29c105e4d63af4362ab9b6b7db598cbca9ffeeeced73274117a8805
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ca1b4104bbfcdd50b8d2216b283b4f3ab9d971a098f59625fc6459ac956e6054
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9D51BF32A207099FDB219F29C881A7AB7F5FF15760F440579EA05D7252E770E920CF40
                                                                                                                                                                                                                                              Function 00289D60 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 87COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,0034CFC4,0034CFC6,?,0034CFC6,?,0034CFC4,ios_base::failbit set,00000000), ref: 00289DB0
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,0034CFC6,?,0034CFC4,ios_base::failbit set,00000000), ref: 00289DC1
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,0034CFC4,0034CFC6,00000000,00000000,?,0034CFC6,?,0034CFC4,ios_base::failbit set,00000000), ref: 00289DD9
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,0034CFC4,?,?,00000000,?,?,?,0034CFC6,?,0034CFC4,ios_base::failbit set,00000000), ref: 00289DFF
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                                              • String ID: ios_base::failbit set
                                                                                                                                                                                                                                              • API String ID: 1717984340-3924258884
                                                                                                                                                                                                                                              • Opcode ID: bd0fcf458714e589a76a0ab6dbda950000a330ccc2de05ac861262eaeed3a23c
                                                                                                                                                                                                                                              • Instruction ID: 304a7a2baf921c68e8bb52f90664aeec2d3c655c4bfd0e0e47463aa2650826a9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd0fcf458714e589a76a0ab6dbda950000a330ccc2de05ac861262eaeed3a23c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2521047A112206BBE3216F60DC44FB7BF5CFF46344F248529FA4556092DB72A4248BA0
                                                                                                                                                                                                                                              Function 00279B0D Relevance: 7.6, APIs: 5, Instructions: 78threadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SetEvent.KERNEL32 ref: 00279B16
                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 00279B29
                                                                                                                                                                                                                                                • Part of subcall function 002C66B6: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 002C66C1
                                                                                                                                                                                                                                                • Part of subcall function 002C66B6: GetExitCodeThread.KERNEL32(?,?), ref: 002C66D3
                                                                                                                                                                                                                                                • Part of subcall function 002C66B6: CloseHandle.KERNEL32(?), ref: 002C66EC
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00279B81
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00279B97
                                                                                                                                                                                                                                              • __Mtx_destroy_in_situ.LIBCPMT ref: 00279BAF
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseHandle$Thread$CodeCurrentEventExitMtx_destroy_in_situObjectSingleWait
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2780651522-0
                                                                                                                                                                                                                                              • Opcode ID: 95970c01711b63aaab2fb53168a8bcf1dab89d05aea0a0837f55a7a44cabc52d
                                                                                                                                                                                                                                              • Instruction ID: 7e04d97bec0ad32f4f439d141451a6e16d2f79825d800ae9ed5c9ff3088838d3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 95970c01711b63aaab2fb53168a8bcf1dab89d05aea0a0837f55a7a44cabc52d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 95212730520B019BD720FF749C4AF8AB6E99F94324F108A2DF95E811C1DB32A9B0CE81
                                                                                                                                                                                                                                              Function 002C43F0 Relevance: 7.6, APIs: 5, Instructions: 76COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C43F7
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C4401
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C4452
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C4472
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C447F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                              • Opcode ID: 61044f3970131ada9e3db05d3d76053a1233ccd53ec8c2d5fc130b4ee4ac96f0
                                                                                                                                                                                                                                              • Instruction ID: 64ea8d1626af9e978c38d928ca019ca2f60414d1e4d6bba6b7630f2ff2a317cd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 61044f3970131ada9e3db05d3d76053a1233ccd53ec8c2d5fc130b4ee4ac96f0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2011D3329242199BCB19FB64A811FAEB7A5AF44720F24454EF904A73D1DF709E258B90
                                                                                                                                                                                                                                              Function 002C3EA7 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • ___std_fs_open_handle@16.LIBCPMT ref: 002C3EC0
                                                                                                                                                                                                                                                • Part of subcall function 002C3E73: CreateFileW.KERNEL32(02200000,00010000,00000007,00000000,00000003,?,00000000,00000000,?,002C3EC5,?,?,00010000,02200000,?,00000000), ref: 002C3E88
                                                                                                                                                                                                                                                • Part of subcall function 002C3E73: GetLastError.KERNEL32(?,002C3EC5,?,?,00010000,02200000,?,00000000), ref: 002C3E98
                                                                                                                                                                                                                                              • SetFileInformationByHandle.KERNEL32(?,00000015,00000000,00000004,?,?,00010000,02200000,?,00000000), ref: 002C3EFC
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002C3F0C
                                                                                                                                                                                                                                              • SetFileInformationByHandle.KERNEL32(?,00000004,?,00000001), ref: 002C3F38
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002C3F45
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLast$HandleInformation$Create___std_fs_open_handle@16
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1118473077-0
                                                                                                                                                                                                                                              • Opcode ID: 1a5fd5f6b1180828e99058c42fc2596ce767ce417559a0f2eb770c7a7072ab66
                                                                                                                                                                                                                                              • Instruction ID: a06d205adeef2b6e79bf673fe209caa54026f28a8aeca01728c18049cd19bb9c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a5fd5f6b1180828e99058c42fc2596ce767ce417559a0f2eb770c7a7072ab66
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8B11F631918146EADB15DE788D1CFBE7FB8AF51300F048A5CF501A2651D7B28B24C751
                                                                                                                                                                                                                                              Function 002C7579 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Maklocstr$Maklocchr
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2020259771-0
                                                                                                                                                                                                                                              • Opcode ID: 8a6fc9a3643f333a2b0e49f18554bfd02ffb7ac6e63ef626afe6259c058cda67
                                                                                                                                                                                                                                              • Instruction ID: 2188227f2f900172b76bd0dbbaf719927a695b6334a3d3dba7e8b5e0a7f5f3e6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8a6fc9a3643f333a2b0e49f18554bfd02ffb7ac6e63ef626afe6259c058cda67
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88118FB5518B487BE720DBA48881F12B7ACBF08360F044A1DF5858BA80D265FC648BA5
                                                                                                                                                                                                                                              Function 002677FD Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 00267804
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00267811
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 0026785F
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0026787F
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0026788C
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3498242614-0
                                                                                                                                                                                                                                              • Opcode ID: 011fdcdf4cdd014cf9533ae5a0f1752a36fff7e3617729d66d6564a51434e52f
                                                                                                                                                                                                                                              • Instruction ID: 9ea5681104c4d26c3f26f5ce15435575cedaf6af4ab0741e869f34311bbc54a7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 011fdcdf4cdd014cf9533ae5a0f1752a36fff7e3617729d66d6564a51434e52f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D301D23692410ADBCB05EBA4D845BAD7769AF88714F240249F901A73D2CF709E55CFE1
                                                                                                                                                                                                                                              Function 00267892 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 00267899
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002678A6
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002678F4
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00267914
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00267921
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3498242614-0
                                                                                                                                                                                                                                              • Opcode ID: 1340c8baf8e9590c80004b4420783f7ee4b104deffbf2868817811c2624379e0
                                                                                                                                                                                                                                              • Instruction ID: 24d85279c511a0df585578aa8babeb28244a3e09ad99a0d2d3bc13840471153d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1340c8baf8e9590c80004b4420783f7ee4b104deffbf2868817811c2624379e0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7C01223692520ADBCB02FB64D842ABD77B4AF84714F200549F800A73C1CF309EA58F90
                                                                                                                                                                                                                                              Function 002D459F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D45A6
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D45B0
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D4601
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D4621
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D462E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                              • Opcode ID: 4dd82167045e9336a5705daccfc5cd1993f1153da55773edc6adcddf2eb42de1
                                                                                                                                                                                                                                              • Instruction ID: 69d3e4db3ef4856ceed51cf9a7d142b817ad11d7dc6fd3dca9299535d07d1d0a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4dd82167045e9336a5705daccfc5cd1993f1153da55773edc6adcddf2eb42de1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE01AD399202299BCB05FB64D855AAEB779AF44724F24450AE811AB3D1DF70DE14CBD0
                                                                                                                                                                                                                                              Function 002D4634 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D463B
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D4645
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D4696
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D46B6
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D46C3
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                              • Opcode ID: fa86252cb7322e8968bf1944eb4ce2e5d3223b0a446195bb52a50cdbf9da9976
                                                                                                                                                                                                                                              • Instruction ID: e25c7193e13d1298e6d07bc0423e3a2360b36c6d8d710ca25863404d429a6928
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa86252cb7322e8968bf1944eb4ce2e5d3223b0a446195bb52a50cdbf9da9976
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EC01003592021A9BCB01FB64D801AADB7B9BF45720F24490AE8116B3E0CF70DE148FC0
                                                                                                                                                                                                                                              Function 002D47F3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D47FA
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D4804
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D4855
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D4875
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D4882
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                              • Opcode ID: d8ef1b61d0c2d25aa612dfca3c1c6a8ddc38fbc515bb43c4c0310f4b4dfcbc35
                                                                                                                                                                                                                                              • Instruction ID: 2185b3635f1ff948acb78fe56087b0e29dfc382f6801b435444ac39e5bd0d073
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d8ef1b61d0c2d25aa612dfca3c1c6a8ddc38fbc515bb43c4c0310f4b4dfcbc35
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D301003592025A8BCB05FB64C815AAEB776BF80764F24450AE810AB3D0CF709E55DB80
                                                                                                                                                                                                                                              Function 002D4888 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002D488F
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002D4899
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002D48EA
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002D490A
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002D4917
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                              • Opcode ID: 7c1d2d22541ced4f7927217368f4c64d63d64422ababd9de0706fa856cc8cbe0
                                                                                                                                                                                                                                              • Instruction ID: 79e17174eed800ccd2f5c617420ed9509aaeb2fff1894543d762b87fd01b249b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7c1d2d22541ced4f7927217368f4c64d63d64422ababd9de0706fa856cc8cbe0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0801C43592021A9BCF05FB64D815AAE7775BF44320F24454AF810A73D1DF749E15CF90
                                                                                                                                                                                                                                              Function 002C7C31 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002C7C38
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002C7C42
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::_Lockit.LIBCPMT ref: 00262D30
                                                                                                                                                                                                                                                • Part of subcall function 00262D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00262D4C
                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 002C7C93
                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 002C7CB3
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002C7CC0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                              • Opcode ID: 8d04968e7e1b6f823d3c9ccb83944a59e8818439c69498a6674ca12d35427082
                                                                                                                                                                                                                                              • Instruction ID: 02874a6585765af2f7961049cf5604a1999418e67489b8647d12543b60c37166
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8d04968e7e1b6f823d3c9ccb83944a59e8818439c69498a6674ca12d35427082
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7701D6359241169BCB05EB64D805FADB775BF44720F244A0EF8106B3E1DF709E548F90
                                                                                                                                                                                                                                              Function 002FB487 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FB49F
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: RtlFreeHeap.NTDLL(00000000,00000000,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?), ref: 002F20AE
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: GetLastError.KERNEL32(?,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?,?), ref: 002F20C0
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FB4B1
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FB4C3
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FB4D5
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002FB4E7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 776569668-0
                                                                                                                                                                                                                                              • Opcode ID: 01948e1847e7f55372299b9482e3bbb09243f9c293bf592272d4ff8c5caae619
                                                                                                                                                                                                                                              • Instruction ID: 902aac84c0061fef783f5b01d954617e2a9f79f9b9e9935e67c1815dcee2e0ae
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 01948e1847e7f55372299b9482e3bbb09243f9c293bf592272d4ff8c5caae619
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F4F0443756060CAF8532DF64E5A1C26B7DDEA127D0B584829F209DB601CF24FC94CA50
                                                                                                                                                                                                                                              Function 002B0720 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 19COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 002B0743
                                                                                                                                                                                                                                              • CloseHandle failed: %d, xrefs: 002B0737
                                                                                                                                                                                                                                              • NWebAdvisor::CCabParser::Close, xrefs: 002B073E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                              • String ID: CloseHandle failed: %d$NWebAdvisor::CCabParser::Close$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
                                                                                                                                                                                                                                              • API String ID: 918212764-1823807987
                                                                                                                                                                                                                                              • Opcode ID: 4eed98158d45d5d2b670b6563523d937c95880385cc285961827b16454bc5a40
                                                                                                                                                                                                                                              • Instruction ID: 56dae974562cddcf1357a88aa05acb9577430fecbbd3b690a4489fbb9a2b643b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4eed98158d45d5d2b670b6563523d937c95880385cc285961827b16454bc5a40
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75D05B317503307EEB221B68FC0AFD6759CDB05714F040A29FA15E50E2D5E2B8519755
                                                                                                                                                                                                                                              Function 002C52EC Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 317COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002C52F3
                                                                                                                                                                                                                                                • Part of subcall function 0028BDF0: std::_Lockit::_Lockit.LIBCPMT ref: 0028BE2F
                                                                                                                                                                                                                                                • Part of subcall function 0028BDF0: std::_Lockit::_Lockit.LIBCPMT ref: 0028BE51
                                                                                                                                                                                                                                                • Part of subcall function 0028BDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0028BE71
                                                                                                                                                                                                                                                • Part of subcall function 0028BDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0028BFFC
                                                                                                                                                                                                                                              • _Find_elem.LIBCPMT ref: 002C54EF
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
                                                                                                                                                                                                                                              • String ID: 0123456789ABCDEFabcdef-+Xx$l8],
                                                                                                                                                                                                                                              • API String ID: 3042121994-3740520772
                                                                                                                                                                                                                                              • Opcode ID: 089f7af429f6991b6d200e547033c8f0ecfce06b8ef41c4a08acea3cd7076167
                                                                                                                                                                                                                                              • Instruction ID: f28f168e7b0e8166a1eda01541f3ebb7610f0d18b08ff2e2815cbf4e5e254cb9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 089f7af429f6991b6d200e547033c8f0ecfce06b8ef41c4a08acea3cd7076167
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 91C18230D246A98EDF25DFA4C450FECBBB66F55300F68425DD8856B286C770EDA6CB10
                                                                                                                                                                                                                                              Function 00279C2D Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: 1$Async event sender already initialized$`ato
                                                                                                                                                                                                                                              • API String ID: 0-1237675990
                                                                                                                                                                                                                                              • Opcode ID: 42445612361e56d2e6a7917433243411c7d5b4370520548193bf8d9ac5d195e3
                                                                                                                                                                                                                                              • Instruction ID: fb50af751e12db7ca1489af8b36e193a6436d54726d68964755d965c59923b65
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42445612361e56d2e6a7917433243411c7d5b4370520548193bf8d9ac5d195e3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0CC18D71620B408BDB18CB34CC99BABB7A9EB40315F548A1DE15EC76A0DB39B994CF14
                                                                                                                                                                                                                                              Function 0027B6E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 219COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027B886
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027B93D
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Failed to convert wide to byte, xrefs: 0027B90D
                                                                                                                                                                                                                                              • Failed to convert byte to wide, xrefs: 0027B856
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitialize
                                                                                                                                                                                                                                              • String ID: Failed to convert byte to wide$Failed to convert wide to byte
                                                                                                                                                                                                                                              • API String ID: 1656330964-1708777540
                                                                                                                                                                                                                                              • Opcode ID: 48bebdb108951fe1857dd38027a49e5fbb9824456d9c655020a7312a36c7634f
                                                                                                                                                                                                                                              • Instruction ID: 0955a67fd4bd6f65e393ad911b3d41fd0448f827ec8f22f8b05cb3412cd2f07b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 48bebdb108951fe1857dd38027a49e5fbb9824456d9c655020a7312a36c7634f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6811F70D202088BDF19DFA4C985BEDBBB5EF45304F108098E9196B281DB35AA99CF61
                                                                                                                                                                                                                                              Function 003051F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: \\?\
                                                                                                                                                                                                                                              • API String ID: 0-4282027825
                                                                                                                                                                                                                                              • Opcode ID: 30ceb142aa39f3f38e80e047efc12ce0c06dfbe6370646d06dda7cbb8afc277f
                                                                                                                                                                                                                                              • Instruction ID: 30920f21fbbb8b66729186633ad2d35596d653dc4630a22feb6849a70abf0579
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 30ceb142aa39f3f38e80e047efc12ce0c06dfbe6370646d06dda7cbb8afc277f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DC718C71D11618DBCF16DFA8C894AEEB7F9BF49310F15062AE816E7290D730A950CFA1
                                                                                                                                                                                                                                              Function 0026B420 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 184COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0026B64C
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_
                                                                                                                                                                                                                                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                                                                              • API String ID: 323602529-1866435925
                                                                                                                                                                                                                                              • Opcode ID: 9294536a1f6332134b1f947ea55cd8e39db54b416057190153c2cfa0e464b75f
                                                                                                                                                                                                                                              • Instruction ID: 5781a632d877136a8459946f9437ceda8872e893643f7ed58eb5d927fc3b54d1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9294536a1f6332134b1f947ea55cd8e39db54b416057190153c2cfa0e464b75f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B671ABB5A1060AEFCB16CF18C984B9AFBF4FF08314F14856AE9158B381DB75A955CF80
                                                                                                                                                                                                                                              Function 00304620 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 159COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000000), ref: 003046E4
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00304728
                                                                                                                                                                                                                                              • WritePrivateProfileStructW.KERNEL32(?,00000000,?,00000004,00000000), ref: 00304768
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: PrivateProfileStructWrite$ErrorLast
                                                                                                                                                                                                                                              • String ID: MCRG
                                                                                                                                                                                                                                              • API String ID: 3778923442-1523812224
                                                                                                                                                                                                                                              • Opcode ID: 2d9c0b3ed00c67641202c16bed1d55b0605f233f9d41f2dae06583b7b35410fa
                                                                                                                                                                                                                                              • Instruction ID: 0e6945c542f41ea7fa04bc8f148c38e1f6ce17342faed1059b62773f622082d7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2d9c0b3ed00c67641202c16bed1d55b0605f233f9d41f2dae06583b7b35410fa
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA51A175901249AFDB11CFA8D844F9EFBF8EF49720F148259F925AB2A1DB709904CF90
                                                                                                                                                                                                                                              Function 00270490 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002C3D98: FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,?,002704D5,?,?,1CE34B5F), ref: 002C3DAE
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000), ref: 002705CC
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 002705F6
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_taskFormatFreeLocalMessage
                                                                                                                                                                                                                                              • String ID: generic$unknown error
                                                                                                                                                                                                                                              • API String ID: 3868770561-3628847473
                                                                                                                                                                                                                                              • Opcode ID: 5d0515893345706fd7bfd1f010832df424fb770a895fe70df6e4997b6831426b
                                                                                                                                                                                                                                              • Instruction ID: 892addec7debc8e06325fde0f849a8b8c791ab87119dabe29a28274848fe6331
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5d0515893345706fd7bfd1f010832df424fb770a895fe70df6e4997b6831426b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6141D4B0924345DFDB209F68C885B6FBBE8FF45310F50462EE45697381DBB899188F91
                                                                                                                                                                                                                                              Function 002EEA12 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\is-NAQL6.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                              • API String ID: 0-1251932004
                                                                                                                                                                                                                                              • Opcode ID: 9fdcfc36b3faf49c015a763f4c33038f4d7531e0f4681c583dafc73462813ab6
                                                                                                                                                                                                                                              • Instruction ID: 72d5d71f2e4919c333b3937a6772d2871cbae3da8f78c73d5e63b44a00a44c75
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9fdcfc36b3faf49c015a763f4c33038f4d7531e0f4681c583dafc73462813ab6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F31A471AA0659EBCF22DF9ADC81D9EBBBCFB94310B51006AE405A7360E7B08D54CB50
                                                                                                                                                                                                                                              Function 00264A4A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: H_prolog3_
                                                                                                                                                                                                                                              • String ID: /affid$MSAD_Subinfo$affid
                                                                                                                                                                                                                                              • API String ID: 2427045233-3897642808
                                                                                                                                                                                                                                              • Opcode ID: 6dc3f60865050ce23aac01cd79b613cbf3d640b5df06a0f5d086715d1cd9e611
                                                                                                                                                                                                                                              • Instruction ID: 9e2bb844b3ac51d2b8dcb6eb09d615910a93dd9678178de217a2df3006301e71
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6dc3f60865050ce23aac01cd79b613cbf3d640b5df06a0f5d086715d1cd9e611
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C7419174D20208DECF09EFA8C8A5AEDBBB4FF09314F14406EE445A7281D7309A9ACF55
                                                                                                                                                                                                                                              Function 002D2F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002D2F57
                                                                                                                                                                                                                                                • Part of subcall function 002C7DF0: __EH_prolog3.LIBCMT ref: 002C7DF7
                                                                                                                                                                                                                                                • Part of subcall function 002C7DF0: std::_Lockit::_Lockit.LIBCPMT ref: 002C7E01
                                                                                                                                                                                                                                                • Part of subcall function 002C7DF0: std::_Lockit::~_Lockit.LIBCPMT ref: 002C7E72
                                                                                                                                                                                                                                              • _Find_elem.LIBCPMT ref: 002D2FF3
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
                                                                                                                                                                                                                                              • String ID: %.0Lf$0123456789-
                                                                                                                                                                                                                                              • API String ID: 2544715827-3094241602
                                                                                                                                                                                                                                              • Opcode ID: 9a2553b00e15aca55a6929235e5102a290a4a5538720c9ed6312eda2bc924227
                                                                                                                                                                                                                                              • Instruction ID: 50ea7aaf6d10d1ca2566dd0be1f4bc4a5f7aeff74158ea412df582139fd2ab38
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a2553b00e15aca55a6929235e5102a290a4a5538720c9ed6312eda2bc924227
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9415A31920219DFCF15DFA4C880AEDBBB9FF18314F10016AE811AB255DB309E66CFA1
                                                                                                                                                                                                                                              Function 002D3200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002D3207
                                                                                                                                                                                                                                                • Part of subcall function 002632DE: __EH_prolog3_GS.LIBCMT ref: 002632E5
                                                                                                                                                                                                                                                • Part of subcall function 002632DE: std::_Lockit::_Lockit.LIBCPMT ref: 002632F2
                                                                                                                                                                                                                                                • Part of subcall function 002632DE: std::_Lockit::~_Lockit.LIBCPMT ref: 00263360
                                                                                                                                                                                                                                              • _Find_elem.LIBCPMT ref: 002D32A3
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: H_prolog3_Lockitstd::_$Find_elemLockit::_Lockit::~_
                                                                                                                                                                                                                                              • String ID: 0123456789-$0123456789-
                                                                                                                                                                                                                                              • API String ID: 3328206922-2494171821
                                                                                                                                                                                                                                              • Opcode ID: a91f9c670d24ac892f34a0614012e216131b53c93293b50190f6d3d77220b6dc
                                                                                                                                                                                                                                              • Instruction ID: a7a4142bbdc5d83bff81df0db12e65a47f923223634e9e91f35b217b521d93a6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a91f9c670d24ac892f34a0614012e216131b53c93293b50190f6d3d77220b6dc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 06414D71910219DFCF05DFA4D885ADDBBB5FF08310F10016AE911AB255DB309E66CFA2
                                                                                                                                                                                                                                              Function 002D7470 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002D7477
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::_Lockit.LIBCPMT ref: 0028C995
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::_Lockit.LIBCPMT ref: 0028C9B7
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0028C9D7
                                                                                                                                                                                                                                                • Part of subcall function 0028C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0028CAB1
                                                                                                                                                                                                                                              • _Find_elem.LIBCPMT ref: 002D7511
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
                                                                                                                                                                                                                                              • String ID: 0123456789-$0123456789-
                                                                                                                                                                                                                                              • API String ID: 3042121994-2494171821
                                                                                                                                                                                                                                              • Opcode ID: 4a8892f5ba59989b3becdb1f701d2b32d6c16121aed1e21d60bef2630142d52c
                                                                                                                                                                                                                                              • Instruction ID: 4010cb5c728fd1af3b967749afc3843556701867bce8a78f9e6e7ef30d9bf62a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a8892f5ba59989b3becdb1f701d2b32d6c16121aed1e21d60bef2630142d52c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54416D31911209DFCF06EFA4D880A9EBBB9FF14310F50409AF911AB291EB359E66CF51
                                                                                                                                                                                                                                              Function 0028D700 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • SHGetKnownFolderPath.SHELL32(0032D7E8,00000000,00000000,?,1CE34B5F), ref: 0028D75C
                                                                                                                                                                                                                                              • CoTaskMemFree.OLE32(00000000), ref: 0028D7D4
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FolderFreeKnownPathTask
                                                                                                                                                                                                                                              • String ID: %s\%s
                                                                                                                                                                                                                                              • API String ID: 969438705-4073750446
                                                                                                                                                                                                                                              • Opcode ID: b765338d31f2c5b92faccfed08430cd30acdbe1838a5392102666834f23fe6a6
                                                                                                                                                                                                                                              • Instruction ID: 691283bc286c0a62d0c3abf79ad567f75c4070eb74b4dd50ed4fe764a5296a29
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b765338d31f2c5b92faccfed08430cd30acdbe1838a5392102666834f23fe6a6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 66216FB5A112189BEB05DFA9DC85FEEF7B8EB48714F504529E801A32C0DB746914CB60
                                                                                                                                                                                                                                              Function 00277156 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00284B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0028521E
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00277D3D
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 00277DC8
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitializeMtx_unlock
                                                                                                                                                                                                                                              • String ID: Failed to add event category ($V
                                                                                                                                                                                                                                              • API String ID: 2287862619-1647955383
                                                                                                                                                                                                                                              • Opcode ID: 4b00a3cbadcec4e429bbc64e6729aabd8f643ffc48ade9b2037d0a26c580612a
                                                                                                                                                                                                                                              • Instruction ID: 56b98ce7cf29b736aedc4b8fed7aa49addd5ebdadd580f9f4db34eef7fd2957a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4b00a3cbadcec4e429bbc64e6729aabd8f643ffc48ade9b2037d0a26c580612a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8C319370924248CFDF04EF60D856BDD77B4EF55304F508099E8065B342EB75AA68CFA2
                                                                                                                                                                                                                                              Function 0027A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,1CE34B5F,?,?), ref: 0027A531
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 0027A7EC
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027A989
                                                                                                                                                                                                                                                • Part of subcall function 0027F110: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0027F268
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Unexpected return value: , xrefs: 0027A8CC
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
                                                                                                                                                                                                                                              • String ID: Unexpected return value:
                                                                                                                                                                                                                                              • API String ID: 1703231451-3613193034
                                                                                                                                                                                                                                              • Opcode ID: d50247f32300f6ddea8769870e9d83cececbb0b2fe8e05e1cf5aa6f681ad0206
                                                                                                                                                                                                                                              • Instruction ID: 208e5e56516542f23588401d567e32609be13f6af889b6e6fa46a884935bbf5b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d50247f32300f6ddea8769870e9d83cececbb0b2fe8e05e1cf5aa6f681ad0206
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E621B470D31104DADB15DFA4DC49BEDB739AF85324F508258E019A72C1DB309AA5CE12
                                                                                                                                                                                                                                              Function 002D5C3A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Mpunct$H_prolog3
                                                                                                                                                                                                                                              • String ID: $+xv
                                                                                                                                                                                                                                              • API String ID: 4281374311-1686923651
                                                                                                                                                                                                                                              • Opcode ID: 0a438eada68279f4e94b01cb233fc3c784a369742870c5497ecb041c03b087fc
                                                                                                                                                                                                                                              • Instruction ID: ef7b663ed4a2525a97d9d41a4f901ef13618a80f777a448da345c0bd09b5188e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a438eada68279f4e94b01cb233fc3c784a369742870c5497ecb041c03b087fc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C92183A1924B926FDB21DF74C450B3B7EF8AB08300B04095BE459C7A41E774EA15CF90
                                                                                                                                                                                                                                              Function 002CDD07 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 002CDD0E
                                                                                                                                                                                                                                                • Part of subcall function 002C7579: _Maklocstr.LIBCPMT ref: 002C7599
                                                                                                                                                                                                                                                • Part of subcall function 002C7579: _Maklocstr.LIBCPMT ref: 002C75B6
                                                                                                                                                                                                                                                • Part of subcall function 002C7579: _Maklocstr.LIBCPMT ref: 002C75D3
                                                                                                                                                                                                                                                • Part of subcall function 002C7579: _Maklocchr.LIBCPMT ref: 002C75E5
                                                                                                                                                                                                                                                • Part of subcall function 002C7579: _Maklocchr.LIBCPMT ref: 002C75F8
                                                                                                                                                                                                                                              • _Mpunct.LIBCPMT ref: 002CDD9B
                                                                                                                                                                                                                                              • _Mpunct.LIBCPMT ref: 002CDDB5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Maklocstr$MaklocchrMpunct$H_prolog3
                                                                                                                                                                                                                                              • String ID: $+xv
                                                                                                                                                                                                                                              • API String ID: 2939335142-1686923651
                                                                                                                                                                                                                                              • Opcode ID: 5ee03e46baabad66f9f279383ee43e8575561b368ac3cef10ee26e9a3eaa25fc
                                                                                                                                                                                                                                              • Instruction ID: f11face3ae7b42858663160cad9bf09ee17f131c748c1cea7858689f6d05e453
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5ee03e46baabad66f9f279383ee43e8575561b368ac3cef10ee26e9a3eaa25fc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D32195B1914B526FDB21DF748850B3B7EF8AB09700F044A5EE459C7A41D730EA11CF90
                                                                                                                                                                                                                                              Function 00277052 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceBeginInitialize.KERNEL32(003580C4,00000000,1CE34B5F,00000000,1CE34B5F,0026A219,003580CC,?,?,?,?,?,?,0026A219,?,?), ref: 00269BE5
                                                                                                                                                                                                                                                • Part of subcall function 00269BB0: InitOnceComplete.KERNEL32(003580C4,00000000,00000000), ref: 00269C1D
                                                                                                                                                                                                                                                • Part of subcall function 00269940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00269A12
                                                                                                                                                                                                                                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00277D3D
                                                                                                                                                                                                                                              • __Mtx_unlock.LIBCPMT ref: 00277DC8
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitializeMtx_unlock
                                                                                                                                                                                                                                              • String ID: P$Service has not been initialized
                                                                                                                                                                                                                                              • API String ID: 920826028-2917841385
                                                                                                                                                                                                                                              • Opcode ID: fa927fe9d37f259bfc0a9c23646c8e0eac0d4d9199af965e6e83489a0c48a39a
                                                                                                                                                                                                                                              • Instruction ID: 743382eb100732a92e50f858e751731d6b998738da1fe16f0ca43ef2f795b370
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa927fe9d37f259bfc0a9c23646c8e0eac0d4d9199af965e6e83489a0c48a39a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C5017C75A24248CEDF04EFA0D852BEDB368AF55304F50846AE80657281EF75AAACCE51
                                                                                                                                                                                                                                              Function 0026308E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00263095
                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 002630A2
                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002630DF
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: std::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                                                                                                              • String ID: bad locale name
                                                                                                                                                                                                                                              • API String ID: 4089677319-1405518554
                                                                                                                                                                                                                                              • Opcode ID: 704d9aa348a0870480ad09907990889548259dddf3b5f9652ef1bf6dcf953052
                                                                                                                                                                                                                                              • Instruction ID: 2501aacd832cefe91d5006f4eaabf305ef5a6dcb049ed34434b6d2122b0ea8fa
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 704d9aa348a0870480ad09907990889548259dddf3b5f9652ef1bf6dcf953052
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 95014F70415B80DEC721DF7A848164AFAE0BF28300B548A6FE08E83A41CB30A614CB6A
                                                                                                                                                                                                                                              Function 0028D6D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,00264E6C,1CE34B5F), ref: 0028D6D5
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0028D6E5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                              • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                                                                              • API String ID: 1646373207-2102062458
                                                                                                                                                                                                                                              • Opcode ID: 89eb29425b79bcc7f60eb439dd015f48c33fc06b743df45fdbfcdc7b6a379d05
                                                                                                                                                                                                                                              • Instruction ID: 0c8565f4646e9d23c2b1427f7f16c0678c12e7a4e8e16086e55985f6da58cf42
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 89eb29425b79bcc7f60eb439dd015f48c33fc06b743df45fdbfcdc7b6a379d05
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99D0122475572A16DE126FB32E09B8E174C7A89BC2F088860E405D70D0DDE5C404CB61
                                                                                                                                                                                                                                              Function 002F24F8 Relevance: 6.3, APIs: 4, Instructions: 320COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _strrchr
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3213747228-0
                                                                                                                                                                                                                                              • Opcode ID: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
                                                                                                                                                                                                                                              • Instruction ID: 18a73ae45253aac23b40ebb3e6d0e3d6b8e71bd5e51b0712acbaeaea728a901e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44B1563192428ADFDB15DF28C8917BEFBE9EF56380F24407ADA41DB241D6349D19CB60
                                                                                                                                                                                                                                              Function 00302AF0 Relevance: 6.2, APIs: 4, Instructions: 173COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 0026463F: GetProcessHeap.KERNEL32(?,?,?,0028C2E1,?,?,?,1CE34B5F,?,00000000), ref: 00264676
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,0030FB28,000000FF), ref: 00302BF4
                                                                                                                                                                                                                                                • Part of subcall function 002875F0: FindResourceExW.KERNEL32(00000000,00000006,00000000,?,00000000,?,?,?,?,?,00302B5D,?,00000000), ref: 00287628
                                                                                                                                                                                                                                                • Part of subcall function 002875F0: LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00302B5D,?,00000000,?,?,?,?,?,0030FB28), ref: 00287636
                                                                                                                                                                                                                                                • Part of subcall function 002875F0: LockResource.KERNEL32(00000000,?,?,?,?,?,00302B5D,?,00000000,?,?,?,?,?,0030FB28,000000FF), ref: 00287641
                                                                                                                                                                                                                                                • Part of subcall function 002875F0: SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00302B5D,?,00000000,?,?,?,?,?,0030FB28), ref: 0028764F
                                                                                                                                                                                                                                              • FindResourceW.KERNEL32(00000000,?,00000006), ref: 00302B74
                                                                                                                                                                                                                                                • Part of subcall function 00287580: LoadResource.KERNEL32(00000101,00000101,00000000,80070057,8007000E,80004005,00288806,00000000,?,00000000,00000002,00000000), ref: 00287589
                                                                                                                                                                                                                                                • Part of subcall function 00287580: LockResource.KERNEL32(00000000,?,00000000,00000002,00000000), ref: 00287594
                                                                                                                                                                                                                                                • Part of subcall function 00287580: SizeofResource.KERNEL32(00000101,00000101,?,00000000,00000002,00000000), ref: 002875A8
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 00302BAB
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,0030FB28,000000FF), ref: 00302C2E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof$HeapProcess
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2838002939-0
                                                                                                                                                                                                                                              • Opcode ID: eb22ddf8facaea8b2203295822651b8f256c3d5f3935fa30247baed9d3e01884
                                                                                                                                                                                                                                              • Instruction ID: b0a94e1243755d4b9cb2f5f653917ab36214f8af639781088d0e269cf579fa91
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: eb22ddf8facaea8b2203295822651b8f256c3d5f3935fa30247baed9d3e01884
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B051BE30201641AFE72ACF19CCADF2AB7E8EF54710F25465DFA419B2D1DBB5A800CB51
                                                                                                                                                                                                                                              Function 002DC0E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                                                                              • Opcode ID: a2a3263c96229087ae5aad623be7e01378a3ef453a04deebf14d9826355317fb
                                                                                                                                                                                                                                              • Instruction ID: c6de2c4765ace5cd43e9c6a3fad239940e55f35886b6233d77ce1909b070f0a5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a2a3263c96229087ae5aad623be7e01378a3ef453a04deebf14d9826355317fb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C351BE72624213AFEB299F94D845BBAB7A4FF04714F34412BEC0956392D771ECA1CB90
                                                                                                                                                                                                                                              Function 002F3531 Relevance: 6.1, APIs: 4, Instructions: 132COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: dcc30dc8edc72eae0524612c47b5c2c488859d3e24fa8f63d69c43108b64d1e3
                                                                                                                                                                                                                                              • Instruction ID: 5c8cd3f61af37883f8f6842cb92ad208d25a1de874df0277a8b43544b94fd61a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dcc30dc8edc72eae0524612c47b5c2c488859d3e24fa8f63d69c43108b64d1e3
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FC41CAB1A20708BFD725DF78C841B7AFBA9EB88750F10453AF151DB381D671AA558B80
                                                                                                                                                                                                                                              Function 0030174E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 0030181E
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 00301847
                                                                                                                                                                                                                                              • SetEndOfFile.KERNEL32(00000000,003000BA,00000000,003002C3,?,?,?,?,?,?,?,003000BA,003002C3,00000000), ref: 00301879
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,003000BA,003002C3,00000000,?,?,?,?,00000000), ref: 00301895
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$ErrorFileLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1547350101-0
                                                                                                                                                                                                                                              • Opcode ID: 04e92854d72c65ab5755052ed78ac46d689417cc807c51e45deda461c792f228
                                                                                                                                                                                                                                              • Instruction ID: 4cf1d4fa95c8f609f76753cf17d976602cd827bd511d7d041d86eac5ae57dfb5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 04e92854d72c65ab5755052ed78ac46d689417cc807c51e45deda461c792f228
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 29412772911605ABDB23AFB8CC52BADB7A9EF44360F254161F924E72D1EB31CD108B61
                                                                                                                                                                                                                                              Function 0028EBA0 Relevance: 6.1, APIs: 4, Instructions: 90registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RegSetKeySecurity.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0028EBCB
                                                                                                                                                                                                                                              • RegEnumKeyExW.ADVAPI32(00000000,00000000,?,00000100,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0028EC28
                                                                                                                                                                                                                                              • RegOpenKeyExW.ADVAPI32(00000000,?,00000000,000F003F,?,?,00000000,00000000), ref: 0028EC4F
                                                                                                                                                                                                                                                • Part of subcall function 0028EBA0: RegCloseKey.ADVAPI32(?,?,00000000,00000000), ref: 0028EC7E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseEnumOpenSecurity
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 611561417-0
                                                                                                                                                                                                                                              • Opcode ID: c55386599e231c719cc06fb88ebcb69524f847810d4e46cd354866e3c7dc3f0e
                                                                                                                                                                                                                                              • Instruction ID: 885988cbbeddd877237a24f1c34ba20317cc588dd6195db9c7bbf6820db206e1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c55386599e231c719cc06fb88ebcb69524f847810d4e46cd354866e3c7dc3f0e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F631C076A0121CABCF21EF54DD49FEAB3BCFB08700F0145A6F919A6191DA709E60CF90
                                                                                                                                                                                                                                              Function 002EE0E7 Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 2c92d28a6304d8c69d91eb0f24b28d1cd7d81deb410d76d4b91dfec3ac6b9412
                                                                                                                                                                                                                                              • Instruction ID: 646f164e296deccf3b53236bdf1876787956842569aee0fedd7257a186973ee7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2c92d28a6304d8c69d91eb0f24b28d1cd7d81deb410d76d4b91dfec3ac6b9412
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7121D771264246BFEF10AF62CC8197BB7ACEF443A47924525F92D9B240D731DCA08BA0
                                                                                                                                                                                                                                              Function 002875F0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002D987E: EnterCriticalSection.KERNEL32(003577A0,?,00000101,?,002886A7,00000000,?,00000101,?,00000000,?,?,0028C338,-00000010), ref: 002D9889
                                                                                                                                                                                                                                                • Part of subcall function 002D987E: LeaveCriticalSection.KERNEL32(003577A0,?,002886A7,00000000,?,00000101,?,00000000,?,?,0028C338,-00000010,?,?,?,1CE34B5F), ref: 002D98B5
                                                                                                                                                                                                                                              • FindResourceExW.KERNEL32(00000000,00000006,00000000,?,00000000,?,?,?,?,?,00302B5D,?,00000000), ref: 00287628
                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00302B5D,?,00000000,?,?,?,?,?,0030FB28), ref: 00287636
                                                                                                                                                                                                                                              • LockResource.KERNEL32(00000000,?,?,?,?,?,00302B5D,?,00000000,?,?,?,?,?,0030FB28,000000FF), ref: 00287641
                                                                                                                                                                                                                                              • SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00302B5D,?,00000000,?,?,?,?,?,0030FB28), ref: 0028764F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 529824247-0
                                                                                                                                                                                                                                              • Opcode ID: 4750e6be96e0df4ebf4c18216a9c01a2d69de159b1669615e0c3c5ef3229e48b
                                                                                                                                                                                                                                              • Instruction ID: 429c27f9fdf33ad2dc95f482a99a1e7ef415491b2c534d7c1c8b1b3e95b78e96
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4750e6be96e0df4ebf4c18216a9c01a2d69de159b1669615e0c3c5ef3229e48b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9E11033A61D6234BD7356E1DAC44A7BB39CDBC4792F200A2DF95283290FB62CC249760
                                                                                                                                                                                                                                              Function 00305D60 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,?,00305B7C,0000FDE9,?,00000000,?), ref: 00305D8B
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00305B7C,0000FDE9,?,00000000,?), ref: 00305D95
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 203985260-0
                                                                                                                                                                                                                                              • Opcode ID: e0d0781f4787daef333f835e93d29716e66829a88b900609244470483bcda659
                                                                                                                                                                                                                                              • Instruction ID: 7aedc716efbbc2691f0e0429759d32ae4054342c520b6c4cdfe784a794448264
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e0d0781f4787daef333f835e93d29716e66829a88b900609244470483bcda659
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7111B232340204BBE7315E59FC14F9BB7ACEB94B71F20453BFA48EA1D1D37168209A64
                                                                                                                                                                                                                                              Function 002F1CA9 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000008,00000016,00000000,002F4E01), ref: 002F1CAE
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1D0B
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1D41
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 002F1D4C
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2283115069-0
                                                                                                                                                                                                                                              • Opcode ID: bd67375182c89641b391de0021350c31dc1e00e2770bce5051fbddedc332e5d6
                                                                                                                                                                                                                                              • Instruction ID: 64580f1790fd4424099ddc7e5ef4bc6f87bac87c31e0cf012c652fb195f023f6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd67375182c89641b391de0021350c31dc1e00e2770bce5051fbddedc332e5d6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89113A3622060DAFDA123A759D86D3BA1AD8BD57F4BA90234F3229E1E1DE61DC344520
                                                                                                                                                                                                                                              Function 002F1E00 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(003580CC,?,?,002DD742,002F21B7,?,?,002D872D,?,?,0026A1ED,0000002C,1CE34B5F), ref: 002F1E05
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1E62
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002F1E98
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,00000006,000000FF,?,002DD742,002F21B7,?,?,002D872D,?,?,0026A1ED,0000002C,1CE34B5F), ref: 002F1EA3
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast_free
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2283115069-0
                                                                                                                                                                                                                                              • Opcode ID: 5e4e5827a62f54377ee5ee977f35e3682bf7e354d38b09e019425a1920596bf9
                                                                                                                                                                                                                                              • Instruction ID: f4b6795b5d8904bee256f8ecf38dc1410e43308f27f94e3ab5aab3fae4b00045
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5e4e5827a62f54377ee5ee977f35e3682bf7e354d38b09e019425a1920596bf9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1115C32320109AFCB0236759D86D37A1DD9BD53F0BE90134FB119E1E1DE61DC344520
                                                                                                                                                                                                                                              Function 002C3E04 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000001,00000400,?,1CE34B5F,00000000,00000000,00000000,00000000,?,?,?,0026EE58,00000000,1CE34B5F,?,00000000), ref: 002C3E21
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,0026EE58,00000000,1CE34B5F,?,00000000,00000000,1CE34B5F,?), ref: 002C3E2D
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000001,00000000,?,1CE34B5F,00000000,00000000,00000000,00000000,?,0026EE58,00000000,1CE34B5F,?,00000000,00000000,1CE34B5F), ref: 002C3E53
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,0026EE58,00000000,1CE34B5F,?,00000000,00000000,1CE34B5F,?), ref: 002C3E5F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 203985260-0
                                                                                                                                                                                                                                              • Opcode ID: cf018fea43738736d7ad93807eed18ac9cf4a9cb55371be6207b9052d93f6294
                                                                                                                                                                                                                                              • Instruction ID: 84afb11f6abbbb7f918ffc9d87c46ee686127778eeac8060613f7dc95be6c584
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cf018fea43738736d7ad93807eed18ac9cf4a9cb55371be6207b9052d93f6294
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9801EC3261015ABBCF225F96DC08D9B3E7AEFD9791B10C528FE0555120C7328922EBA1
                                                                                                                                                                                                                                              Function 00301647 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • WriteConsoleW.KERNEL32(0029860A,1CE34B5F,0034C218,00000000,0029860A,?,002FF9C7,0029860A,00000001,0029860A,0029860A,?,002F5B42,00000000,?,0029860A), ref: 0030165E
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,002FF9C7,0029860A,00000001,0029860A,0029860A,?,002F5B42,00000000,?,0029860A,00000000,0029860A,?,002F6096,0029860A), ref: 0030166A
                                                                                                                                                                                                                                                • Part of subcall function 00301630: CloseHandle.KERNEL32(FFFFFFFE,0030167A,?,002FF9C7,0029860A,00000001,0029860A,0029860A,?,002F5B42,00000000,?,0029860A,00000000,0029860A), ref: 00301640
                                                                                                                                                                                                                                              • ___initconout.LIBCMT ref: 0030167A
                                                                                                                                                                                                                                                • Part of subcall function 003015F0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0030161F,002FF9B4,0029860A,?,002F5B42,00000000,?,0029860A,00000000), ref: 00301603
                                                                                                                                                                                                                                              • WriteConsoleW.KERNEL32(0029860A,1CE34B5F,0034C218,00000000,?,002FF9C7,0029860A,00000001,0029860A,0029860A,?,002F5B42,00000000,?,0029860A,00000000), ref: 0030168F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2744216297-0
                                                                                                                                                                                                                                              • Opcode ID: 906c4bb6a8081db94c824302d3a27b4ee5826d3a08536b5731da98f2019eabb2
                                                                                                                                                                                                                                              • Instruction ID: 568587b3932a3757222b1988d7c3c1e052ae59fa6a2fb4db1012ba56d123c3e6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 906c4bb6a8081db94c824302d3a27b4ee5826d3a08536b5731da98f2019eabb2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FFF01C36002118BBCF232F91DC15A9A7F2AFB493A1F058414FE098A1B0D63388209F90
                                                                                                                                                                                                                                              Function 002EF540 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002EF549
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: RtlFreeHeap.NTDLL(00000000,00000000,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?), ref: 002F20AE
                                                                                                                                                                                                                                                • Part of subcall function 002F2098: GetLastError.KERNEL32(?,?,002FB729,?,00000000,?,?,?,002FB9CC,?,00000007,?,?,002FBDD6,?,?), ref: 002F20C0
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002EF55C
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002EF56D
                                                                                                                                                                                                                                              • _free.LIBCMT ref: 002EF57E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 776569668-0
                                                                                                                                                                                                                                              • Opcode ID: 22acc1cfd1a9f90f6cf160bbd36e475d6e3e9b8cb4d37ba4f332980ec6074dda
                                                                                                                                                                                                                                              • Instruction ID: 5f6475dec3bf73b875cfdf34a79272b66aa35ed8ac3304f8818d8885667cd7aa
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 22acc1cfd1a9f90f6cf160bbd36e475d6e3e9b8cb4d37ba4f332980ec6074dda
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40E0B6728A4724EA86236F34FC128597B29A775792B01005AF50977371CF3A056EDF91
                                                                                                                                                                                                                                              Function 002CBBCA Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002CBBD4
                                                                                                                                                                                                                                                • Part of subcall function 002C8616: __EH_prolog3.LIBCMT ref: 002C861D
                                                                                                                                                                                                                                                • Part of subcall function 002C8616: std::_Lockit::_Lockit.LIBCPMT ref: 002C8627
                                                                                                                                                                                                                                                • Part of subcall function 002C8616: std::_Lockit::~_Lockit.LIBCPMT ref: 002C8698
                                                                                                                                                                                                                                              • _Find_elem.LIBCPMT ref: 002CBE0E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • 0123456789ABCDEFabcdef-+Xx, xrefs: 002CBC4B
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
                                                                                                                                                                                                                                              • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                                                                                                                                                                              • API String ID: 2544715827-2799312399
                                                                                                                                                                                                                                              • Opcode ID: f81ec0c6a51800a5e1fd0e9b78efe5e32dc1be966b48e05d7f407c049af8a58d
                                                                                                                                                                                                                                              • Instruction ID: f38a1257ec0b891e48ac8209cccae66ffcf3e83e774dd9bdb6be89db661ddc1c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f81ec0c6a51800a5e1fd0e9b78efe5e32dc1be966b48e05d7f407c049af8a58d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63C1A330E242598FDF22DF64C846BECBB71AF51300F54429EE8866B282DB758D95CF51
                                                                                                                                                                                                                                              Function 002CBFA0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 002CBFAA
                                                                                                                                                                                                                                                • Part of subcall function 00267892: __EH_prolog3_GS.LIBCMT ref: 00267899
                                                                                                                                                                                                                                                • Part of subcall function 00267892: std::_Lockit::_Lockit.LIBCPMT ref: 002678A6
                                                                                                                                                                                                                                                • Part of subcall function 00267892: std::_Lockit::~_Lockit.LIBCPMT ref: 00267914
                                                                                                                                                                                                                                              • _Find_elem.LIBCPMT ref: 002CC1E4
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • 0123456789ABCDEFabcdef-+Xx, xrefs: 002CC021
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: H_prolog3_Lockitstd::_$Find_elemLockit::_Lockit::~_
                                                                                                                                                                                                                                              • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                                                                                                                                                                              • API String ID: 3328206922-2799312399
                                                                                                                                                                                                                                              • Opcode ID: e0d8f1aa820e9c7660ac37be773b035815cfa3cc71620a650c3698b295678c8d
                                                                                                                                                                                                                                              • Instruction ID: d1357195edceb26968aba91c3a3406816dbfc51b423735dfaaa4c0d900e3b95f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e0d8f1aa820e9c7660ac37be773b035815cfa3cc71620a650c3698b295678c8d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 48C1A430D242598FDF15DFA8C844BACBB72BF15300F68829ED84D6B282DB748D95DB51
                                                                                                                                                                                                                                              Function 002EDE2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __startOneArgErrorHandling.LIBCMT ref: 002EDEBD
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorHandling__start
                                                                                                                                                                                                                                              • String ID: pow
                                                                                                                                                                                                                                              • API String ID: 3213639722-2276729525
                                                                                                                                                                                                                                              • Opcode ID: 73137504d5502f89c03bea75f1ae0fc54e62a51366119c60f887304763c369b7
                                                                                                                                                                                                                                              • Instruction ID: 3f8367a34ead8d48e81603db9f0f337ee3d268c45d425055ee91ddd76b8a1aae
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 73137504d5502f89c03bea75f1ae0fc54e62a51366119c60f887304763c369b7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4351AC7193820B86CB13BF15C94237AEB989B50781FA44C79F596861F8EF358CF48E42
                                                                                                                                                                                                                                              Function 002D7B97 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __aulldiv
                                                                                                                                                                                                                                              • String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
                                                                                                                                                                                                                                              • API String ID: 3732870572-1956417402
                                                                                                                                                                                                                                              • Opcode ID: b1722f62afe7c27f1a6a2ec97852b4a3d09a9ebc5b22b54d4e24ba8d334c152f
                                                                                                                                                                                                                                              • Instruction ID: 13b7ac700a1dfa3a9b679c09e72272c7d9a15f2f93ae2c07bb6b78290d1a76f7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b1722f62afe7c27f1a6a2ec97852b4a3d09a9ebc5b22b54d4e24ba8d334c152f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F151D330A3C24A5EDF259E68C4817BEBBF6AF55704F14846BE881D7341E2B88D628B50
                                                                                                                                                                                                                                              Function 00304440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00302AF0: FindResourceW.KERNEL32(00000000,?,00000006), ref: 00302B74
                                                                                                                                                                                                                                                • Part of subcall function 00302AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 00302BAB
                                                                                                                                                                                                                                                • Part of subcall function 00302AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,0030FB28,000000FF), ref: 00302C2E
                                                                                                                                                                                                                                              • WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000002), ref: 0030453C
                                                                                                                                                                                                                                              • WritePrivateProfileStructW.KERNEL32(?,?,00000000,?,00000002), ref: 00304598
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiPrivateProfileStructWideWrite$FindResource
                                                                                                                                                                                                                                              • String ID: MCRG
                                                                                                                                                                                                                                              • API String ID: 2178413835-1523812224
                                                                                                                                                                                                                                              • Opcode ID: a2707130ddcfc38c2c522b60b6b150a9105a29b5f415697c79bd3d99e3e83073
                                                                                                                                                                                                                                              • Instruction ID: dd505bb249b9998591980bbab8460ffa4dfb13871408a978f84f63eae4b13076
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a2707130ddcfc38c2c522b60b6b150a9105a29b5f415697c79bd3d99e3e83073
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4D617871901248AFDB01CFA8C854B9EFBB5EF49320F148259E815AB2A1DB74A905CB90
                                                                                                                                                                                                                                              Function 002871C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00287362
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00287367
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                              • String ID: 'm(
                                                                                                                                                                                                                                              • API String ID: 118556049-665138279
                                                                                                                                                                                                                                              • Opcode ID: eb39fdf9b7fde2adad70ce7654654b007cd0dfb8d97ed23e6eddaa94090875ff
                                                                                                                                                                                                                                              • Instruction ID: 3b68f6ba43f181233dd4eec85f1889d2a6deedaaf3f674541c1e0f5d93935a0d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: eb39fdf9b7fde2adad70ce7654654b007cd0dfb8d97ed23e6eddaa94090875ff
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4751E4B59296018FDB24DF24C841B6AB7F5FF58300F20062EE816977D1DB70E954CB91
                                                                                                                                                                                                                                              Function 002DC6E2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 002DC707
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: EncodePointer
                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                              • API String ID: 2118026453-2084237596
                                                                                                                                                                                                                                              • Opcode ID: 50045140c428449f9b2fe9618463639fed785a0043e1890e2b365905cd343e0d
                                                                                                                                                                                                                                              • Instruction ID: 732993198ab87ce610124e3dbaf881c571319add6e3f4d6caa72c05eaf5f3f6e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 50045140c428449f9b2fe9618463639fed785a0043e1890e2b365905cd343e0d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0541387291020AAFDF16DF98CD81AEEBBB9BF48300F25815AF914A7251D3359D60DF50
                                                                                                                                                                                                                                              Function 0026BED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0026BFD6
                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 0026BFDB
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                              • String ID: ios_base::badbit set
                                                                                                                                                                                                                                              • API String ID: 118556049-3882152299
                                                                                                                                                                                                                                              • Opcode ID: f92bd1b3875eb43ee71ceb7d70d9ff14a31b417b12ea01339a6f3eb4e0da9c53
                                                                                                                                                                                                                                              • Instruction ID: 9307c909365f5e40e2878b48a3e9e6a24697b60d59e38ce1b5f3224a813acc6f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f92bd1b3875eb43ee71ceb7d70d9ff14a31b417b12ea01339a6f3eb4e0da9c53
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C4317CB262460AAFC311DF18D881A56B7A8FF45310F55462AF815C7BA0D770ECB48FE0
                                                                                                                                                                                                                                              Function 002D3B60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: H_prolog3___cftoe
                                                                                                                                                                                                                                              • String ID: !%x
                                                                                                                                                                                                                                              • API String ID: 855520168-1893981228
                                                                                                                                                                                                                                              • Opcode ID: 40fa449e51311b862b7ddf30de292cc54b9b1f9960922a1f928163a6568655be
                                                                                                                                                                                                                                              • Instruction ID: 76512d025f943260a53d133c7f7a534f31626becea92d239632ea9cadd19a7b1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 40fa449e51311b862b7ddf30de292cc54b9b1f9960922a1f928163a6568655be
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA313771D21209ABDF04EF94E981ADDB7B6FF08308F10441AF905A7251DB35AE65CB64
                                                                                                                                                                                                                                              Function 002D7720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: H_prolog3___cftoe
                                                                                                                                                                                                                                              • String ID: !%x
                                                                                                                                                                                                                                              • API String ID: 855520168-1893981228
                                                                                                                                                                                                                                              • Opcode ID: 996211f04c93620f3eb42713e394f5cd19c16f42703204b9228a0266985d263b
                                                                                                                                                                                                                                              • Instruction ID: bd50145a1d78e28b44c225b813ece4f27fcd2d542161bddb24d79fa84d4b1a77
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 996211f04c93620f3eb42713e394f5cd19c16f42703204b9228a0266985d263b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4D314D71924249EFEF05DF94E841AEEBBB5EF09300F14041AF844A7342D7799955DFA0
                                                                                                                                                                                                                                              Function 00267A9B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: H_prolog3_
                                                                                                                                                                                                                                              • String ID: false$true
                                                                                                                                                                                                                                              • API String ID: 2427045233-2658103896
                                                                                                                                                                                                                                              • Opcode ID: ecac9a5ec5e4be451c056070bd2c9193c6ba9196e3af0b5dd649b916ea4707aa
                                                                                                                                                                                                                                              • Instruction ID: 68b090e478fc9370d5a57547d4b8eb75b5820854b8473e1d268363ab1186c792
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ecac9a5ec5e4be451c056070bd2c9193c6ba9196e3af0b5dd649b916ea4707aa
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63218EB5D14244AADB14EFA5D885D9FB7B8FF44704F04808AF9019B252EB70DA50CF60
                                                                                                                                                                                                                                              Function 002F2E58 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _free
                                                                                                                                                                                                                                              • String ID: P|5$T|5
                                                                                                                                                                                                                                              • API String ID: 269201875-977567833
                                                                                                                                                                                                                                              • Opcode ID: 678dd75c0c93be37a61f2c83c3851b4032f647c5e0d7f121ead9e77beea0b996
                                                                                                                                                                                                                                              • Instruction ID: 7d844ab024dc0e9f4d7a45fd02457c88a4f2016a116b4941e91dd6a12638ab36
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 678dd75c0c93be37a61f2c83c3851b4032f647c5e0d7f121ead9e77beea0b996
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2211967112470ADBE724DF25D441AA2F7E8EB167D4B30443EF649C7641D771E8A88B50
                                                                                                                                                                                                                                              Function 002D8367 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002D904B
                                                                                                                                                                                                                                              • ___raise_securityfailure.LIBCMT ref: 002D9133
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                                                                                              • String ID: Xt5
                                                                                                                                                                                                                                              • API String ID: 3761405300-2148458187
                                                                                                                                                                                                                                              • Opcode ID: cdad2d4bb4c6a5a96eec059bd0b04b467c051aab3f9cb3b77f885080700e9f30
                                                                                                                                                                                                                                              • Instruction ID: 3e000b1c328b9a380829a21eb73ce801ca5d7f9ecb2818efcf548a5083b8dc40
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cdad2d4bb4c6a5a96eec059bd0b04b467c051aab3f9cb3b77f885080700e9f30
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1921D3B45193049ED722CF1AFD957443BACBB0A352F10586AE909CB3B0F7B46981CF84
                                                                                                                                                                                                                                              Function 00306290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00302AF0: FindResourceW.KERNEL32(00000000,?,00000006), ref: 00302B74
                                                                                                                                                                                                                                                • Part of subcall function 00302AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 00302BAB
                                                                                                                                                                                                                                                • Part of subcall function 00302AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,0030FB28,000000FF), ref: 00302C2E
                                                                                                                                                                                                                                              • RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,?,00000100,%`0,?,00000000,?,?,?,00306025,?,00000100,00000000,00000100), ref: 003062BB
                                                                                                                                                                                                                                              • RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,%`0,00000100,00000000,00000100), ref: 003062F9
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiQueryValueWide$FindResource
                                                                                                                                                                                                                                              • String ID: %`0
                                                                                                                                                                                                                                              • API String ID: 3794624133-2195916306
                                                                                                                                                                                                                                              • Opcode ID: 7a024e82dfea8d6ae4ca8bb5b0a9367930c64386ab70007a55f404d573f8e77c
                                                                                                                                                                                                                                              • Instruction ID: 6d8ba16b69fabf67279b00b34c3a8508c18097069ac558303558d96bfd84288c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a024e82dfea8d6ae4ca8bb5b0a9367930c64386ab70007a55f404d573f8e77c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E119175500209BFEB129F59CC45F9ABB69FF08360F148161FC189B2A1DB729D20DF90
                                                                                                                                                                                                                                              Function 0028E5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CLSIDFromString.OLE32(0000007B,?), ref: 0028E650
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FromString
                                                                                                                                                                                                                                              • String ID: @${
                                                                                                                                                                                                                                              • API String ID: 1694596556-3118734784
                                                                                                                                                                                                                                              • Opcode ID: be8cf350f0f82e4d38911daa5250d61aa0e85d2b7cd73cf0216c1899cde68128
                                                                                                                                                                                                                                              • Instruction ID: 6e7e8806be9bb55d18ca0890a813d0f92044dd97c0e071ab0c39af2b50ae9e48
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: be8cf350f0f82e4d38911daa5250d61aa0e85d2b7cd73cf0216c1899cde68128
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1C01A575A002189BCB20DF6CD901B9EB3BCFF99710F41819EB849E7150DE74AE94CB90
                                                                                                                                                                                                                                              Function 002F564E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002FACE1: EnterCriticalSection.KERNEL32(?,?,002FF56B,?,0034C6E0,00000010,002F4ED0,00000000,05D1745D,00000004,00000000,00000016,?,00000003), ref: 002FACFC
                                                                                                                                                                                                                                              • FlushFileBuffers.KERNEL32(00000000,0034C518,0000000C,002F5755,JO.,?,00000003,00000003,002E4F4A,?,00000003), ref: 002F5697
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002F56A8
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: BuffersCriticalEnterErrorFileFlushLastSection
                                                                                                                                                                                                                                              • String ID: JO.
                                                                                                                                                                                                                                              • API String ID: 4109680722-695963393
                                                                                                                                                                                                                                              • Opcode ID: b1e8f0915e823a55aa265f83f1589625795b97365ea9d8c88eedc1ca52f5cac9
                                                                                                                                                                                                                                              • Instruction ID: d1014f7edff8b4ee7f240a9d502bdfd34a75104ba53b95dccd2e24e54b25ad4b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b1e8f0915e823a55aa265f83f1589625795b97365ea9d8c88eedc1ca52f5cac9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E201C072A206149FC711EF68D80569DBBA8AF49760F10426BF921DB3A1DB74D811CF40
                                                                                                                                                                                                                                              Function 002D9146 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002D9151
                                                                                                                                                                                                                                              • ___raise_securityfailure.LIBCMT ref: 002D920E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                                                                                              • String ID: Xt5
                                                                                                                                                                                                                                              • API String ID: 3761405300-2148458187
                                                                                                                                                                                                                                              • Opcode ID: 21d07ad917b6e5b8a17f9c47d66178f93d74486912e924023ec6e93caf6f8f20
                                                                                                                                                                                                                                              • Instruction ID: 4b70149aa92942c0b1b30d9d8ccc0558b669ecadef86de47855064ee410b8346
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 21d07ad917b6e5b8a17f9c47d66178f93d74486912e924023ec6e93caf6f8f20
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0611A2B45193449FD712DF1AFD816443BACBB0A342F10586AE80887370F770A546CF95
                                                                                                                                                                                                                                              Function 002C2743 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • DloadGetSRWLockFunctionPointers.DELAYIMP ref: 002C2743
                                                                                                                                                                                                                                                • Part of subcall function 002C26D0: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,002C2748,002C28F1), ref: 002C26E7
                                                                                                                                                                                                                                              • AcquireSRWLockExclusive.KERNEL32(?,002C28F1), ref: 002C2760
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Lock$AcquireDloadExclusiveFunctionHandleModulePointers
                                                                                                                                                                                                                                              • String ID: 8o5
                                                                                                                                                                                                                                              • API String ID: 3692202576-1643110001
                                                                                                                                                                                                                                              • Opcode ID: 266b50866b3c56f6f1c8ee1b59ab387a255090bb141b5310c809844a4d2aa8e5
                                                                                                                                                                                                                                              • Instruction ID: 6b4b5c27fd04e06f6ee2260a3187cd8fccddd40b6148526f81b3335155cacde4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 266b50866b3c56f6f1c8ee1b59ab387a255090bb141b5310c809844a4d2aa8e5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 53E0C238B30312C74F565F25BE86F6AA349AB81746B84027DE912D32A0DE108C9DCA80
                                                                                                                                                                                                                                              Function 002D97CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 002644F8: InitializeCriticalSectionEx.KERNEL32(003577A0,00000000,00000000,0035778C,002D97FC,?,?,?,002611BA), ref: 002644FE
                                                                                                                                                                                                                                                • Part of subcall function 002644F8: GetLastError.KERNEL32(?,?,?,002611BA), ref: 00264508
                                                                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,002611BA), ref: 002D9800
                                                                                                                                                                                                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,002611BA), ref: 002D980F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 002D980A
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
                                                                                                                                                                                                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                                                              • API String ID: 3511171328-631824599
                                                                                                                                                                                                                                              • Opcode ID: 2de8ea98fa8e62bf54fa43e450377f4055fff3da1025478565671463a03e0fe7
                                                                                                                                                                                                                                              • Instruction ID: 39fd9f1b7648dc6f1f38943fdd33cbddd0ffd3c53aac61dce2b434e19d91ffdf
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2de8ea98fa8e62bf54fa43e450377f4055fff3da1025478565671463a03e0fe7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E3E06D706107218FD361AF25E8457427BE8AB08B05F00C92EE899D2350EBB1D8988FA1
                                                                                                                                                                                                                                              Function 00305E10 Relevance: 5.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,00000000,?,?,?,003059F1,0000FDE9,?,?,?), ref: 00305E33
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,003059F1,0000FDE9,?,?,?), ref: 00305E3D
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000005.00000002.2630044619.0000000000251000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00250000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2629945159.0000000000250000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630328015.000000000031E000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630461805.000000000034F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630610875.0000000000354000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630652865.0000000000356000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000005.00000002.2630699270.0000000000359000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_5_2_250000_saBSI.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 203985260-0
                                                                                                                                                                                                                                              • Opcode ID: 11414d5095b6dfd9073bf1c8c754484328db92047190348b93504294fc5bab4c
                                                                                                                                                                                                                                              • Instruction ID: ca5314677fb88d07ac881d38358e7837001902d6b7ddce859ed8136ec80b47ce
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 11414d5095b6dfd9073bf1c8c754484328db92047190348b93504294fc5bab4c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C31182333012046BD7219E69FC44F9BB79CEB99771F20493AF594D61D1D3715810DA60

                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                              Execution Coverage:11.5%
                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                              Signature Coverage:5.9%
                                                                                                                                                                                                                                              Total number of Nodes:1981
                                                                                                                                                                                                                                              Total number of Limit Nodes:26
                                                                                                                                                                                                                                              execution_graph 16956 a52ba0 16959 a52e10 16956->16959 16957 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16958 a5316b 16957->16958 16960 a53171 16959->16960 16964 a52e94 BuildCatchObjectHelperInternal 16959->16964 16979 a53144 16959->16979 16961 a53bf0 45 API calls 16960->16961 16962 a53176 16961->16962 16963 a53bf0 45 API calls 16962->16963 16965 a5317b 16963->16965 16964->16962 16972 a52f2d 16964->16972 16966 a64650 26 API calls 16965->16966 16967 a53180 16966->16967 16968 a53e50 45 API calls 16969 a53039 16968->16969 16970 a53e50 45 API calls 16969->16970 16971 a53048 16970->16971 16973 a53099 FindResourceW 16971->16973 16981 a65043 16971->16981 16972->16965 16972->16968 16974 a530af LoadResource SizeofResource 16973->16974 16975 a53118 16973->16975 16974->16975 16977 a530cf 16974->16977 16975->16965 16975->16979 16977->16975 16978 a530d3 CreateFileW 16977->16978 16978->16975 16980 a530fb WriteFile CloseHandle 16978->16980 16979->16957 16980->16975 16984 a64f7a 16981->16984 16985 a64f91 16984->16985 16992 a64fa9 16984->16992 16986 a64dd3 __fassign 38 API calls 16985->16986 16987 a64f9c 16986->16987 16988 a65007 16987->16988 16989 a64fd7 16987->16989 16987->16992 16993 a68dab 16988->16993 16990 a68c20 GetStringTypeW 16989->16990 16990->16992 16992->16971 16994 a68db8 16993->16994 16997 a6b40c 16994->16997 16998 a6b138 __dosmaperr 5 API calls 16997->16998 16999 a6b433 16998->16999 17002 a6b43c 16999->17002 17005 a6b494 16999->17005 17003 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 17002->17003 17004 a68de6 17003->17004 17004->16992 17006 a6b138 __dosmaperr 5 API calls 17005->17006 17007 a6b4bb 17006->17007 17008 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 17007->17008 17009 a6b47c LCMapStringW 17008->17009 17009->17002 17046 a63cb8 17047 a63c5a __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 17046->17047 17048 a63cd3 17047->17048 17053 a63cfa 17047->17053 17050 a6854a FindHandler 38 API calls 17048->17050 17052 a63cd8 __FrameHandler3::FrameUnwindToState 17048->17052 17051 a63d13 17050->17051 17058 a62fec 17053->17058 17055 a63cff 17056 a63d0a 17055->17056 17057 a62fec FindHandler 48 API calls 17055->17057 17056->17048 17057->17056 17071 a62ffa 17058->17071 17060 a62ff1 17060->17055 17083 a6c0a6 17060->17083 17064 a68672 IsProcessorFeaturePresent 17066 a6867d 17064->17066 17065 a68668 17065->17064 17070 a68690 17065->17070 17068 a64476 _abort 8 API calls 17066->17068 17067 a67d76 _abort 28 API calls 17069 a6869a 17067->17069 17068->17070 17070->17067 17072 a63006 GetLastError 17071->17072 17073 a63003 17071->17073 17113 a64040 17072->17113 17073->17060 17076 a63080 SetLastError 17076->17060 17077 a6407b ___vcrt_FlsSetValue 6 API calls 17078 a63034 FindHandler 17077->17078 17079 a6305c 17078->17079 17080 a6407b ___vcrt_FlsSetValue 6 API calls 17078->17080 17082 a6303a 17078->17082 17081 a6407b ___vcrt_FlsSetValue 6 API calls 17079->17081 17079->17082 17080->17079 17081->17082 17082->17076 17118 a6c014 17083->17118 17086 a6c101 17087 a6c10d FindHandler 17086->17087 17088 a68b29 __dosmaperr 20 API calls 17087->17088 17091 a6c13a _abort 17087->17091 17094 a6c134 _abort 17087->17094 17088->17094 17089 a6c186 17090 a6517e __mbsinc 20 API calls 17089->17090 17092 a6c18b 17090->17092 17098 a6c1b2 17091->17098 17132 a6b0d1 EnterCriticalSection 17091->17132 17095 a64640 __mbsinc 26 API calls 17092->17095 17093 a71b19 _abort 5 API calls 17097 a6c308 17093->17097 17094->17089 17094->17091 17112 a6c169 17094->17112 17095->17112 17097->17065 17099 a6c211 17098->17099 17101 a6c209 17098->17101 17109 a6c23c 17098->17109 17133 a6b121 LeaveCriticalSection 17098->17133 17099->17109 17134 a6c0f8 17099->17134 17104 a67d76 _abort 28 API calls 17101->17104 17104->17099 17106 a68aa5 FindHandler 38 API calls 17110 a6c29f 17106->17110 17108 a6c0f8 _abort 38 API calls 17108->17109 17137 a6c2c1 17109->17137 17111 a68aa5 FindHandler 38 API calls 17110->17111 17110->17112 17111->17112 17112->17093 17114 a63f5b try_get_function 5 API calls 17113->17114 17115 a6405a 17114->17115 17116 a64072 TlsGetValue 17115->17116 17117 a6301b 17115->17117 17116->17117 17117->17076 17117->17077 17117->17082 17121 a6bfba 17118->17121 17120 a6865d 17120->17065 17120->17086 17122 a6bfc6 ___DestructExceptionObject 17121->17122 17127 a6b0d1 EnterCriticalSection 17122->17127 17124 a6bfd4 17128 a6c008 17124->17128 17126 a6bffb __onexit 17126->17120 17127->17124 17131 a6b121 LeaveCriticalSection 17128->17131 17130 a6c012 17130->17126 17131->17130 17132->17098 17133->17101 17135 a68aa5 FindHandler 38 API calls 17134->17135 17136 a6c0fd 17135->17136 17136->17108 17138 a6c2c7 17137->17138 17139 a6c290 17137->17139 17141 a6b121 LeaveCriticalSection 17138->17141 17139->17106 17139->17110 17139->17112 17141->17139 14621 a60684 14622 a60623 14621->14622 14622->14621 14624 a57ae6 14622->14624 14650 a57847 14624->14650 14626 a57af6 14627 a57b53 14626->14627 14632 a57b77 14626->14632 14628 a57a84 DloadReleaseSectionWriteAccess 8 API calls 14627->14628 14629 a57b5e RaiseException 14628->14629 14630 a57d4c 14629->14630 14630->14622 14631 a57bef LoadLibraryExA 14633 a57c50 14631->14633 14634 a57c02 GetLastError 14631->14634 14632->14631 14632->14633 14636 a57c62 14632->14636 14645 a57d1e 14632->14645 14633->14636 14637 a57c5b FreeLibrary 14633->14637 14638 a57c15 14634->14638 14639 a57c2b 14634->14639 14635 a57cc0 GetProcAddress 14641 a57cd0 GetLastError 14635->14641 14635->14645 14636->14635 14636->14645 14637->14636 14638->14633 14638->14639 14640 a57a84 DloadReleaseSectionWriteAccess 8 API calls 14639->14640 14642 a57c36 RaiseException 14640->14642 14643 a57ce3 14641->14643 14642->14630 14643->14645 14646 a57a84 DloadReleaseSectionWriteAccess 8 API calls 14643->14646 14661 a57a84 14645->14661 14647 a57d04 RaiseException 14646->14647 14648 a57847 DloadAcquireSectionWriteAccess 8 API calls 14647->14648 14649 a57d1b 14648->14649 14649->14645 14651 a57853 14650->14651 14652 a57879 14650->14652 14669 a578ed 14651->14669 14652->14626 14654 a57874 14679 a5787a 14654->14679 14655 a57858 14655->14654 14674 a57a16 14655->14674 14659 a57adb 14659->14626 14660 a57ad7 RtlReleaseSRWLockExclusive 14660->14626 14662 a57a96 14661->14662 14663 a57ab8 14661->14663 14664 a578ed DloadAcquireSectionWriteAccess 4 API calls 14662->14664 14663->14630 14665 a57a9b 14664->14665 14666 a57ab3 14665->14666 14667 a57a16 DloadProtectSection 3 API calls 14665->14667 14689 a57aba 14666->14689 14667->14666 14670 a5787a DloadGetSRWLockFunctionPointers 3 API calls 14669->14670 14671 a578f2 14670->14671 14672 a5790a RtlAcquireSRWLockExclusive 14671->14672 14673 a5790e 14671->14673 14672->14655 14673->14655 14675 a57a2b DloadObtainSection 14674->14675 14676 a57a66 VirtualProtect 14675->14676 14677 a57a31 14675->14677 14685 a5792c VirtualQuery 14675->14685 14676->14677 14677->14654 14680 a57888 14679->14680 14683 a5789d 14679->14683 14681 a5788c GetModuleHandleW 14680->14681 14680->14683 14682 a578a1 GetProcAddress 14681->14682 14681->14683 14682->14683 14684 a578b1 GetProcAddress 14682->14684 14683->14659 14683->14660 14684->14683 14686 a57947 14685->14686 14687 a57989 14686->14687 14688 a57952 GetSystemInfo 14686->14688 14687->14676 14688->14687 14690 a5787a DloadGetSRWLockFunctionPointers 3 API calls 14689->14690 14691 a57abf 14690->14691 14692 a57adb 14691->14692 14693 a57ad7 RtlReleaseSRWLockExclusive 14691->14693 14692->14663 14693->14663 18209 a69d80 18219 a6e367 18209->18219 18213 a69d8d 18232 a6e448 18213->18232 18216 a69db7 18217 a68de9 _free 20 API calls 18216->18217 18218 a69dc2 18217->18218 18236 a6e370 18219->18236 18221 a69d88 18222 a6e21a 18221->18222 18223 a6e226 ___DestructExceptionObject 18222->18223 18256 a6b0d1 EnterCriticalSection 18223->18256 18225 a6e29c 18270 a6e2b1 18225->18270 18227 a6e270 DeleteCriticalSection 18228 a68de9 _free 20 API calls 18227->18228 18231 a6e231 18228->18231 18229 a6e2a8 __onexit 18229->18213 18231->18225 18231->18227 18257 a6f873 18231->18257 18233 a6e45e 18232->18233 18235 a69d9c DeleteCriticalSection 18232->18235 18234 a68de9 _free 20 API calls 18233->18234 18233->18235 18234->18235 18235->18213 18235->18216 18237 a6e37c ___DestructExceptionObject 18236->18237 18246 a6b0d1 EnterCriticalSection 18237->18246 18239 a6e41f 18251 a6e43f 18239->18251 18242 a6e42b __onexit 18242->18221 18244 a6e38b 18244->18239 18245 a6e320 66 API calls 18244->18245 18247 a69dcc EnterCriticalSection 18244->18247 18248 a6e415 18244->18248 18245->18244 18246->18244 18247->18244 18254 a69de0 LeaveCriticalSection 18248->18254 18250 a6e41d 18250->18244 18255 a6b121 LeaveCriticalSection 18251->18255 18253 a6e446 18253->18242 18254->18250 18255->18253 18256->18231 18258 a6f87f ___DestructExceptionObject 18257->18258 18259 a6f8a5 18258->18259 18260 a6f890 18258->18260 18261 a6f8a0 __onexit 18259->18261 18273 a69dcc EnterCriticalSection 18259->18273 18262 a6517e __mbsinc 20 API calls 18260->18262 18261->18231 18264 a6f895 18262->18264 18265 a64640 __mbsinc 26 API calls 18264->18265 18265->18261 18266 a6f8c1 18274 a6f7fd 18266->18274 18268 a6f8cc 18290 a6f8e9 18268->18290 18538 a6b121 LeaveCriticalSection 18270->18538 18272 a6e2b8 18272->18229 18273->18266 18275 a6f81f 18274->18275 18276 a6f80a 18274->18276 18280 a6f81a 18275->18280 18293 a6e2ba 18275->18293 18277 a6517e __mbsinc 20 API calls 18276->18277 18279 a6f80f 18277->18279 18282 a64640 __mbsinc 26 API calls 18279->18282 18280->18268 18282->18280 18283 a6e448 20 API calls 18284 a6f83b 18283->18284 18299 a69c87 18284->18299 18286 a6f841 18306 a70af3 18286->18306 18289 a68de9 _free 20 API calls 18289->18280 18537 a69de0 LeaveCriticalSection 18290->18537 18292 a6f8f1 18292->18261 18294 a6e2ce 18293->18294 18295 a6e2d2 18293->18295 18294->18283 18295->18294 18296 a69c87 26 API calls 18295->18296 18297 a6e2f2 18296->18297 18321 a6f46d 18297->18321 18300 a69c93 18299->18300 18301 a69ca8 18299->18301 18302 a6517e __mbsinc 20 API calls 18300->18302 18301->18286 18303 a69c98 18302->18303 18304 a64640 __mbsinc 26 API calls 18303->18304 18305 a69ca3 18304->18305 18305->18286 18307 a70b02 18306->18307 18312 a70b17 18306->18312 18308 a6516b __dosmaperr 20 API calls 18307->18308 18311 a70b07 18308->18311 18309 a70b52 18310 a6516b __dosmaperr 20 API calls 18309->18310 18313 a70b57 18310->18313 18314 a6517e __mbsinc 20 API calls 18311->18314 18312->18309 18315 a70b3e 18312->18315 18316 a6517e __mbsinc 20 API calls 18313->18316 18319 a6f847 18314->18319 18494 a70acb 18315->18494 18318 a70b5f 18316->18318 18320 a64640 __mbsinc 26 API calls 18318->18320 18319->18280 18319->18289 18320->18319 18322 a6f479 ___DestructExceptionObject 18321->18322 18323 a6f481 18322->18323 18324 a6f499 18322->18324 18346 a6516b 18323->18346 18326 a6f537 18324->18326 18331 a6f4ce 18324->18331 18328 a6516b __dosmaperr 20 API calls 18326->18328 18330 a6f53c 18328->18330 18329 a6517e __mbsinc 20 API calls 18339 a6f48e __onexit 18329->18339 18332 a6517e __mbsinc 20 API calls 18330->18332 18349 a6b71d EnterCriticalSection 18331->18349 18334 a6f544 18332->18334 18336 a64640 __mbsinc 26 API calls 18334->18336 18335 a6f4d4 18337 a6f505 18335->18337 18338 a6f4f0 18335->18338 18336->18339 18350 a6f558 18337->18350 18341 a6517e __mbsinc 20 API calls 18338->18341 18339->18294 18343 a6f4f5 18341->18343 18342 a6f500 18401 a6f52f 18342->18401 18344 a6516b __dosmaperr 20 API calls 18343->18344 18344->18342 18347 a68b29 __dosmaperr 20 API calls 18346->18347 18348 a65170 18347->18348 18348->18329 18349->18335 18351 a6f586 18350->18351 18389 a6f57f 18350->18389 18352 a6f58a 18351->18352 18353 a6f5a9 18351->18353 18355 a6516b __dosmaperr 20 API calls 18352->18355 18356 a6f5dd 18353->18356 18357 a6f5fa 18353->18357 18354 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 18358 a6f760 18354->18358 18359 a6f58f 18355->18359 18360 a6516b __dosmaperr 20 API calls 18356->18360 18361 a6f610 18357->18361 18404 a6f7e2 18357->18404 18358->18342 18362 a6517e __mbsinc 20 API calls 18359->18362 18366 a6f5e2 18360->18366 18407 a6f0fd 18361->18407 18364 a6f596 18362->18364 18367 a64640 __mbsinc 26 API calls 18364->18367 18369 a6517e __mbsinc 20 API calls 18366->18369 18367->18389 18372 a6f5ea 18369->18372 18370 a6f657 18376 a6f6b1 WriteFile 18370->18376 18377 a6f66b 18370->18377 18371 a6f61e 18373 a6f644 18371->18373 18374 a6f622 18371->18374 18375 a64640 __mbsinc 26 API calls 18372->18375 18419 a6eedd GetConsoleCP 18373->18419 18380 a6f718 18374->18380 18414 a6f090 18374->18414 18375->18389 18382 a6f6d4 GetLastError 18376->18382 18387 a6f63a 18376->18387 18378 a6f673 18377->18378 18379 a6f6a1 18377->18379 18383 a6f691 18378->18383 18384 a6f678 18378->18384 18445 a6f173 18379->18445 18380->18389 18390 a6517e __mbsinc 20 API calls 18380->18390 18382->18387 18437 a6f340 18383->18437 18384->18380 18430 a6f252 18384->18430 18387->18380 18387->18389 18391 a6f6f4 18387->18391 18389->18354 18393 a6f73d 18390->18393 18395 a6f70f 18391->18395 18396 a6f6fb 18391->18396 18394 a6516b __dosmaperr 20 API calls 18393->18394 18394->18389 18452 a65148 18395->18452 18397 a6517e __mbsinc 20 API calls 18396->18397 18399 a6f700 18397->18399 18400 a6516b __dosmaperr 20 API calls 18399->18400 18400->18389 18493 a6b740 LeaveCriticalSection 18401->18493 18403 a6f535 18403->18339 18457 a6f764 18404->18457 18479 a6e486 18407->18479 18409 a6f10d 18410 a6f112 18409->18410 18411 a68aa5 FindHandler 38 API calls 18409->18411 18410->18370 18410->18371 18413 a6f135 18411->18413 18412 a6f153 GetConsoleMode 18412->18410 18413->18410 18413->18412 18417 a6f0b5 18414->18417 18418 a6f0ea 18414->18418 18415 a70a04 WriteConsoleW CreateFileW 18415->18417 18416 a6f0ec GetLastError 18416->18418 18417->18415 18417->18416 18417->18418 18418->18387 18420 a6f052 18419->18420 18424 a6ef40 18419->18424 18421 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 18420->18421 18423 a6f08c 18421->18423 18423->18387 18424->18420 18425 a6efc6 WideCharToMultiByte 18424->18425 18427 a69258 40 API calls __fassign 18424->18427 18429 a6f01d WriteFile 18424->18429 18488 a68bfa 18424->18488 18425->18420 18426 a6efec WriteFile 18425->18426 18426->18424 18428 a6f075 GetLastError 18426->18428 18427->18424 18428->18420 18429->18424 18429->18428 18435 a6f261 18430->18435 18431 a6f323 18432 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 18431->18432 18434 a6f33c 18432->18434 18433 a6f2df WriteFile 18433->18435 18436 a6f325 GetLastError 18433->18436 18434->18387 18435->18431 18435->18433 18436->18431 18444 a6f34f 18437->18444 18438 a6f45a 18439 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 18438->18439 18440 a6f469 18439->18440 18440->18387 18441 a6f3d1 WideCharToMultiByte 18442 a6f406 WriteFile 18441->18442 18443 a6f452 GetLastError 18441->18443 18442->18443 18442->18444 18443->18438 18444->18438 18444->18441 18444->18442 18450 a6f182 18445->18450 18446 a6f235 18447 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 18446->18447 18451 a6f24e 18447->18451 18448 a6f1f4 WriteFile 18449 a6f237 GetLastError 18448->18449 18448->18450 18449->18446 18450->18446 18450->18448 18451->18387 18453 a6516b __dosmaperr 20 API calls 18452->18453 18454 a65153 _free 18453->18454 18455 a6517e __mbsinc 20 API calls 18454->18455 18456 a65166 18455->18456 18456->18389 18466 a6b7f4 18457->18466 18459 a6f776 18460 a6f77e 18459->18460 18461 a6f78f SetFilePointerEx 18459->18461 18464 a6517e __mbsinc 20 API calls 18460->18464 18462 a6f783 18461->18462 18463 a6f7a7 GetLastError 18461->18463 18462->18361 18465 a65148 __dosmaperr 20 API calls 18463->18465 18464->18462 18465->18462 18467 a6b801 18466->18467 18469 a6b816 18466->18469 18468 a6516b __dosmaperr 20 API calls 18467->18468 18471 a6b806 18468->18471 18470 a6516b __dosmaperr 20 API calls 18469->18470 18472 a6b83b 18469->18472 18473 a6b846 18470->18473 18474 a6517e __mbsinc 20 API calls 18471->18474 18472->18459 18475 a6517e __mbsinc 20 API calls 18473->18475 18476 a6b80e 18474->18476 18477 a6b84e 18475->18477 18476->18459 18478 a64640 __mbsinc 26 API calls 18477->18478 18478->18476 18480 a6e493 18479->18480 18481 a6e4a0 18479->18481 18482 a6517e __mbsinc 20 API calls 18480->18482 18483 a6e4ac 18481->18483 18484 a6517e __mbsinc 20 API calls 18481->18484 18485 a6e498 18482->18485 18483->18409 18486 a6e4cd 18484->18486 18485->18409 18487 a64640 __mbsinc 26 API calls 18486->18487 18487->18485 18489 a68aa5 FindHandler 38 API calls 18488->18489 18490 a68c05 18489->18490 18491 a68d51 __fassign 38 API calls 18490->18491 18492 a68c15 18491->18492 18492->18424 18493->18403 18497 a70a49 18494->18497 18496 a70aef 18496->18319 18498 a70a55 ___DestructExceptionObject 18497->18498 18508 a6b71d EnterCriticalSection 18498->18508 18500 a70a63 18501 a70a95 18500->18501 18502 a70a8a 18500->18502 18504 a6517e __mbsinc 20 API calls 18501->18504 18509 a70b72 18502->18509 18505 a70a90 18504->18505 18524 a70abf 18505->18524 18507 a70ab2 __onexit 18507->18496 18508->18500 18510 a6b7f4 26 API calls 18509->18510 18513 a70b82 18510->18513 18511 a70b88 18527 a6b763 18511->18527 18513->18511 18514 a70bba 18513->18514 18515 a6b7f4 26 API calls 18513->18515 18514->18511 18516 a6b7f4 26 API calls 18514->18516 18518 a70bb1 18515->18518 18519 a70bc6 CloseHandle 18516->18519 18521 a6b7f4 26 API calls 18518->18521 18519->18511 18522 a70bd2 GetLastError 18519->18522 18520 a70c02 18520->18505 18521->18514 18522->18511 18523 a65148 __dosmaperr 20 API calls 18523->18520 18536 a6b740 LeaveCriticalSection 18524->18536 18526 a70ac9 18526->18507 18528 a6b7d9 18527->18528 18531 a6b772 18527->18531 18529 a6517e __mbsinc 20 API calls 18528->18529 18530 a6b7de 18529->18530 18532 a6516b __dosmaperr 20 API calls 18530->18532 18531->18528 18535 a6b79c 18531->18535 18533 a6b7c9 18532->18533 18533->18520 18533->18523 18534 a6b7c3 SetStdHandle 18534->18533 18535->18533 18535->18534 18536->18526 18537->18292 18538->18272 18584 a68990 18585 a6899b 18584->18585 18589 a689ab 18584->18589 18590 a689b1 18585->18590 18588 a68de9 _free 20 API calls 18588->18589 18591 a689c4 18590->18591 18592 a689ca 18590->18592 18593 a68de9 _free 20 API calls 18591->18593 18594 a68de9 _free 20 API calls 18592->18594 18593->18592 18595 a689d6 18594->18595 18596 a68de9 _free 20 API calls 18595->18596 18597 a689e1 18596->18597 18598 a68de9 _free 20 API calls 18597->18598 18599 a689ec 18598->18599 18600 a68de9 _free 20 API calls 18599->18600 18601 a689f7 18600->18601 18602 a68de9 _free 20 API calls 18601->18602 18603 a68a02 18602->18603 18604 a68de9 _free 20 API calls 18603->18604 18605 a68a0d 18604->18605 18606 a68de9 _free 20 API calls 18605->18606 18607 a68a18 18606->18607 18608 a68de9 _free 20 API calls 18607->18608 18609 a68a23 18608->18609 18610 a68de9 _free 20 API calls 18609->18610 18611 a68a31 18610->18611 18616 a6886c 18611->18616 18622 a68778 18616->18622 18618 a68890 18619 a688bc 18618->18619 18635 a687d9 18619->18635 18621 a688e0 18621->18588 18623 a68784 ___DestructExceptionObject 18622->18623 18630 a6b0d1 EnterCriticalSection 18623->18630 18625 a6878e 18626 a687b8 18625->18626 18629 a68de9 _free 20 API calls 18625->18629 18631 a687cd 18626->18631 18628 a687c5 __onexit 18628->18618 18629->18626 18630->18625 18634 a6b121 LeaveCriticalSection 18631->18634 18633 a687d7 18633->18628 18634->18633 18636 a687e5 ___DestructExceptionObject 18635->18636 18643 a6b0d1 EnterCriticalSection 18636->18643 18638 a687ef 18644 a68a5a 18638->18644 18640 a68802 18648 a68818 18640->18648 18642 a68810 __onexit 18642->18621 18643->18638 18645 a68a90 __fassign 18644->18645 18646 a68a69 __fassign 18644->18646 18645->18640 18646->18645 18647 a6bba7 __fassign 20 API calls 18646->18647 18647->18645 18651 a6b121 LeaveCriticalSection 18648->18651 18650 a68822 18650->18642 18651->18650 17500 a6bee1 17503 a6bf07 17500->17503 17504 a6bf03 17500->17504 17501 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 17502 a6bf69 17501->17502 17503->17504 17505 a69f80 31 API calls 17503->17505 17504->17501 17505->17503 17010 a605f8 17011 a60608 17010->17011 17012 a57ae6 ___delayLoadHelper2@8 17 API calls 17011->17012 17013 a60615 17012->17013 16929 a51020 HeapSetInformation GetModuleHandleW 16930 a51063 SetDllDirectoryW GetModuleHandleW 16929->16930 16931 a5103e GetProcAddress 16929->16931 16932 a510a2 IsProcessorFeaturePresent 16930->16932 16933 a5107d GetProcAddress 16930->16933 16931->16930 16934 a51050 16931->16934 16936 a510c6 16932->16936 16937 a510ae 16932->16937 16933->16932 16935 a5108f 16933->16935 16934->16930 16934->16932 16935->16932 16939 a57fe0 30 API calls 16936->16939 16938 a53b70 9 API calls 16937->16938 16940 a510b8 ExitProcess 16938->16940 16941 a510cb 16939->16941 16942 a510d2 16941->16942 16943 a510ea 16941->16943 16945 a53b70 9 API calls 16942->16945 16948 a608de 16943->16948 16947 a510dc ExitProcess 16945->16947 16951 a61035 16948->16951 16950 a608e3 16950->16950 16952 a6104b 16951->16952 16954 a61054 16952->16954 16955 a60fe8 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 16952->16955 16954->16950 16955->16954 17771 a67e30 17772 a67e3c ___DestructExceptionObject 17771->17772 17773 a67e73 __onexit 17772->17773 17779 a6b0d1 EnterCriticalSection 17772->17779 17775 a67e50 17780 a6be6b 17775->17780 17779->17775 17781 a6be79 __fassign 17780->17781 17783 a67e60 17780->17783 17781->17783 17787 a6bba7 17781->17787 17784 a67e79 17783->17784 17901 a6b121 LeaveCriticalSection 17784->17901 17786 a67e80 17786->17773 17789 a6bc27 17787->17789 17791 a6bbbd 17787->17791 17790 a68de9 _free 20 API calls 17789->17790 17813 a6bc75 17789->17813 17792 a6bc49 17790->17792 17791->17789 17793 a6bbf0 17791->17793 17797 a68de9 _free 20 API calls 17791->17797 17794 a68de9 _free 20 API calls 17792->17794 17799 a68de9 _free 20 API calls 17793->17799 17814 a6bc12 17793->17814 17795 a6bc5c 17794->17795 17798 a68de9 _free 20 API calls 17795->17798 17796 a68de9 _free 20 API calls 17800 a6bc1c 17796->17800 17802 a6bbe5 17797->17802 17804 a6bc6a 17798->17804 17805 a6bc07 17799->17805 17806 a68de9 _free 20 API calls 17800->17806 17801 a6bce3 17807 a68de9 _free 20 API calls 17801->17807 17815 a6b85e 17802->17815 17803 a6bc83 17803->17801 17811 a68de9 20 API calls _free 17803->17811 17809 a68de9 _free 20 API calls 17804->17809 17843 a6b95c 17805->17843 17806->17789 17812 a6bce9 17807->17812 17809->17813 17811->17803 17812->17783 17855 a6bd1a 17813->17855 17814->17796 17816 a6b86f 17815->17816 17817 a6b958 17815->17817 17818 a6b880 17816->17818 17819 a68de9 _free 20 API calls 17816->17819 17817->17793 17820 a6b892 17818->17820 17821 a68de9 _free 20 API calls 17818->17821 17819->17818 17822 a6b8a4 17820->17822 17823 a68de9 _free 20 API calls 17820->17823 17821->17820 17824 a6b8b6 17822->17824 17826 a68de9 _free 20 API calls 17822->17826 17823->17822 17825 a6b8c8 17824->17825 17827 a68de9 _free 20 API calls 17824->17827 17828 a6b8da 17825->17828 17829 a68de9 _free 20 API calls 17825->17829 17826->17824 17827->17825 17830 a6b8ec 17828->17830 17831 a68de9 _free 20 API calls 17828->17831 17829->17828 17832 a6b8fe 17830->17832 17834 a68de9 _free 20 API calls 17830->17834 17831->17830 17833 a6b910 17832->17833 17835 a68de9 _free 20 API calls 17832->17835 17836 a6b922 17833->17836 17837 a68de9 _free 20 API calls 17833->17837 17834->17832 17835->17833 17838 a6b934 17836->17838 17839 a68de9 _free 20 API calls 17836->17839 17837->17836 17840 a6b946 17838->17840 17841 a68de9 _free 20 API calls 17838->17841 17839->17838 17840->17817 17842 a68de9 _free 20 API calls 17840->17842 17841->17840 17842->17817 17844 a6b9c1 17843->17844 17845 a6b969 17843->17845 17844->17814 17846 a6b979 17845->17846 17848 a68de9 _free 20 API calls 17845->17848 17847 a6b98b 17846->17847 17849 a68de9 _free 20 API calls 17846->17849 17850 a6b99d 17847->17850 17851 a68de9 _free 20 API calls 17847->17851 17848->17846 17849->17847 17852 a6b9af 17850->17852 17853 a68de9 _free 20 API calls 17850->17853 17851->17850 17852->17844 17854 a68de9 _free 20 API calls 17852->17854 17853->17852 17854->17844 17856 a6bd45 17855->17856 17857 a6bd27 17855->17857 17856->17803 17857->17856 17861 a6ba01 17857->17861 17860 a68de9 _free 20 API calls 17860->17856 17862 a6badf 17861->17862 17863 a6ba12 17861->17863 17862->17860 17897 a6b9c5 17863->17897 17866 a6b9c5 __fassign 20 API calls 17867 a6ba25 17866->17867 17868 a6b9c5 __fassign 20 API calls 17867->17868 17869 a6ba30 17868->17869 17870 a6b9c5 __fassign 20 API calls 17869->17870 17871 a6ba3b 17870->17871 17872 a6b9c5 __fassign 20 API calls 17871->17872 17873 a6ba49 17872->17873 17874 a68de9 _free 20 API calls 17873->17874 17875 a6ba54 17874->17875 17876 a68de9 _free 20 API calls 17875->17876 17877 a6ba5f 17876->17877 17878 a68de9 _free 20 API calls 17877->17878 17879 a6ba6a 17878->17879 17880 a6b9c5 __fassign 20 API calls 17879->17880 17881 a6ba78 17880->17881 17882 a6b9c5 __fassign 20 API calls 17881->17882 17883 a6ba86 17882->17883 17884 a6b9c5 __fassign 20 API calls 17883->17884 17885 a6ba97 17884->17885 17886 a6b9c5 __fassign 20 API calls 17885->17886 17887 a6baa5 17886->17887 17888 a6b9c5 __fassign 20 API calls 17887->17888 17889 a6bab3 17888->17889 17890 a68de9 _free 20 API calls 17889->17890 17891 a6babe 17890->17891 17892 a68de9 _free 20 API calls 17891->17892 17893 a6bac9 17892->17893 17894 a68de9 _free 20 API calls 17893->17894 17895 a6bad4 17894->17895 17896 a68de9 _free 20 API calls 17895->17896 17896->17862 17898 a6b9fc 17897->17898 17900 a6b9ec 17897->17900 17898->17866 17899 a68de9 _free 20 API calls 17899->17900 17900->17898 17900->17899 17901->17786 19961 a6a303 19966 a6a296 __dosmaperr 19961->19966 19962 a6a2bf 19963 a6517e __mbsinc 20 API calls 19962->19963 19965 a6a2bd 19963->19965 19964 a67f33 __dosmaperr 7 API calls 19964->19966 19966->19962 19966->19964 19966->19965 19967 a6a2aa RtlAllocateHeap 19966->19967 19967->19966 17983 a60619 17984 a60623 17983->17984 17985 a57ae6 ___delayLoadHelper2@8 17 API calls 17984->17985 17985->17984 14694 a60762 14695 a6076e ___DestructExceptionObject 14694->14695 14724 a60d67 14695->14724 14697 a60775 14698 a608c8 14697->14698 14701 a6079f 14697->14701 15166 a610ff IsProcessorFeaturePresent 14698->15166 14700 a608cf 14702 a608d5 14700->14702 15170 a67dc4 14700->15170 14705 a607de ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 14701->14705 15140 a67ae9 14701->15140 15173 a67d76 14702->15173 14711 a6083f 14705->14711 15148 a67d8c 14705->15148 14709 a607be 14735 a61219 14711->14735 14713 a60845 14739 a552f0 InterlockedExchange 14713->14739 14719 a60865 14720 a6086e 14719->14720 15157 a67d67 14719->15157 15160 a60ef6 14720->15160 14725 a60d70 14724->14725 15176 a6153d IsProcessorFeaturePresent 14725->15176 14729 a60d81 14730 a60d85 14729->14730 15187 a684c7 14729->15187 14730->14697 14733 a60d9c 14733->14697 15457 a61ee0 14735->15457 14738 a6123f 14738->14713 15459 a533a0 14739->15459 14744 a55577 15512 a58080 GetModuleHandleW GetProcAddress 14744->15512 14745 a554d6 GetCurrentProcess 15489 a57e70 OpenProcessToken 14745->15489 14749 a55583 14750 a555c7 14749->14750 14751 a55587 InterlockedExchange InterlockedExchange 14749->14751 15526 a53b30 LoadStringW 14750->15526 14753 a555b5 14751->14753 14763 a55523 14751->14763 14757 a53b70 9 API calls 14753->14757 14756 a543e0 59 API calls 14760 a575c8 14756->14760 14757->14763 14764 a54440 61 API calls 14760->14764 14761 a555e9 GetLastError 14762 a5563b 14761->14762 14766 a555f6 InterlockedExchange 14761->14766 15529 a5cf50 14762->15529 14763->14756 14767 a575d4 14764->14767 14768 a53b30 6 API calls 14766->14768 14769 a575e2 CloseHandle 14767->14769 14770 a575e9 14767->14770 14771 a55612 14768->14771 14769->14770 14772 a575f3 CloseHandle 14770->14772 14773 a575fa 14770->14773 15597 a511b0 FindWindowW 14771->15597 14772->14773 14778 a57604 CloseHandle 14773->14778 14779 a5760b 14773->14779 14778->14779 14785 a57fe0 30 API calls 14779->14785 14808 a57610 ___scrt_fastfail 14785->14808 14790 a53b30 6 API calls 14793 a5562d 14790->14793 14792 a5770d 14796 a57725 14792->14796 14797 a57717 ReleaseMutex CloseHandle 14792->14797 14794 a511b0 2 API calls 14793->14794 14798 a55633 14794->14798 15664 a54170 14796->15664 14797->14796 14798->14763 14807 a52d50 26 API calls 14812 a57754 14807->14812 14808->14792 14832 a57699 14808->14832 14815 a52d50 26 API calls 14812->14815 14820 a5775f 14815->14820 14824 a52d50 26 API calls 14820->14824 14826 a5776a 14824->14826 14831 a52d50 26 API calls 14826->14831 14835 a57775 14831->14835 15657 a54000 14832->15657 14840 a52d50 26 API calls 14835->14840 14844 a57780 14840->14844 14841 a576a0 _wcsrchr 14851 a54000 26 API calls 14841->14851 14847 a52d50 26 API calls 14844->14847 14850 a5778b 14847->14850 14854 a52d50 26 API calls 14850->14854 14852 a576b2 _wcsrchr 14851->14852 15661 a54800 14852->15661 14855 a57796 14854->14855 14861 a52d50 26 API calls 14855->14861 14862 a577a1 14861->14862 14867 a52d50 26 API calls 14862->14867 14871 a577ac 14867->14871 14876 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 14871->14876 14872 a54800 26 API calls 14878 a576dd 14872->14878 14881 a577c6 14876->14881 14883 a54000 26 API calls 14878->14883 15155 a6124f GetModuleHandleW 14881->15155 14887 a576e7 CreateHardLinkW 14883->14887 14887->14792 14892 a576f9 14887->14892 14898 a54000 26 API calls 14892->14898 14902 a57706 CopyFileW 14898->14902 14902->14792 15143 a67b00 15140->15143 15141 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15142 a607b8 15141->15142 15142->14709 15144 a67a8d 15142->15144 15143->15141 15147 a67abc 15144->15147 15145 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15146 a67ae5 15145->15146 15146->14705 15147->15145 15149 a67db4 __onexit 15148->15149 15150 a6854a FindHandler 15148->15150 15149->14711 15151 a68aa5 FindHandler 38 API calls 15150->15151 15154 a6855b 15151->15154 15152 a68658 _abort 38 API calls 15153 a68585 15152->15153 15154->15152 15156 a60861 15155->15156 15156->14700 15156->14719 16844 a67b41 15157->16844 15161 a60f02 15160->15161 15162 a60876 15161->15162 16922 a684d9 15161->16922 15162->14709 15165 a62da4 ___vcrt_uninitialize 8 API calls 15165->15162 15167 a61114 ___scrt_fastfail 15166->15167 15168 a611bf IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15167->15168 15169 a6120a ___scrt_fastfail 15168->15169 15169->14700 15171 a67b41 _abort 28 API calls 15170->15171 15172 a67dd5 15171->15172 15172->14702 15174 a67b41 _abort 28 API calls 15173->15174 15175 a608dd 15174->15175 15177 a60d7c 15176->15177 15178 a62d7b 15177->15178 15179 a62d80 ___vcrt_initialize_winapi_thunks 15178->15179 15198 a63e2c 15179->15198 15183 a62da1 15183->14729 15184 a62d96 15184->15183 15212 a63e68 15184->15212 15186 a62d8e 15186->14729 15253 a6beea 15187->15253 15190 a62da4 15191 a62dbe 15190->15191 15192 a62dad 15190->15192 15191->14730 15193 a630bf ___vcrt_uninitialize_ptd 6 API calls 15192->15193 15194 a62db2 15193->15194 15195 a63e68 ___vcrt_uninitialize_locks DeleteCriticalSection 15194->15195 15196 a62db7 15195->15196 15453 a64129 15196->15453 15199 a63e35 15198->15199 15201 a63e5e 15199->15201 15202 a62d8a 15199->15202 15216 a640b9 15199->15216 15203 a63e68 ___vcrt_uninitialize_locks DeleteCriticalSection 15201->15203 15202->15186 15204 a6308c 15202->15204 15203->15202 15234 a63fca 15204->15234 15207 a630a1 15207->15184 15210 a630bc 15210->15184 15213 a63e92 15212->15213 15214 a63e73 15212->15214 15213->15186 15215 a63e7d DeleteCriticalSection 15214->15215 15215->15213 15215->15215 15221 a63f5b 15216->15221 15218 a640d3 15219 a640f1 InitializeCriticalSectionAndSpinCount 15218->15219 15220 a640dc 15218->15220 15219->15220 15220->15199 15222 a63f83 15221->15222 15226 a63f7f __crt_fast_encode_pointer 15221->15226 15222->15226 15227 a63e97 15222->15227 15225 a63f9d GetProcAddress 15225->15226 15226->15218 15231 a63ea6 15227->15231 15228 a63ec3 LoadLibraryExW 15229 a63ede GetLastError 15228->15229 15228->15231 15229->15231 15230 a63f39 FreeLibrary 15230->15231 15231->15228 15231->15230 15232 a63f50 15231->15232 15233 a63f11 LoadLibraryExW 15231->15233 15232->15225 15232->15226 15233->15231 15235 a63f5b try_get_function 5 API calls 15234->15235 15236 a63fe4 15235->15236 15237 a63ffd TlsAlloc 15236->15237 15238 a63096 15236->15238 15238->15207 15239 a6407b 15238->15239 15240 a63f5b try_get_function 5 API calls 15239->15240 15241 a64095 15240->15241 15242 a640b0 TlsSetValue 15241->15242 15243 a630af 15241->15243 15242->15243 15243->15210 15244 a630bf 15243->15244 15245 a630cf 15244->15245 15246 a630c9 15244->15246 15245->15207 15248 a64005 15246->15248 15249 a63f5b try_get_function 5 API calls 15248->15249 15250 a6401f 15249->15250 15251 a64037 TlsFree 15250->15251 15252 a6402b 15250->15252 15251->15252 15252->15245 15256 a6bf07 15253->15256 15257 a6bf03 15253->15257 15255 a60d8e 15255->14733 15255->15190 15256->15257 15259 a69f80 15256->15259 15271 a60bbe 15257->15271 15260 a69f8c ___DestructExceptionObject 15259->15260 15278 a6b0d1 EnterCriticalSection 15260->15278 15262 a69f93 15279 a6b685 15262->15279 15264 a69fa2 15270 a69fb1 15264->15270 15292 a69e09 GetStartupInfoW 15264->15292 15268 a69fc2 __onexit 15268->15256 15303 a69fcd 15270->15303 15272 a60bc7 15271->15272 15273 a60bc9 IsProcessorFeaturePresent 15271->15273 15272->15255 15275 a613e7 15273->15275 15452 a613ab SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15275->15452 15277 a614ca 15277->15255 15278->15262 15280 a6b691 ___DestructExceptionObject 15279->15280 15281 a6b6b5 15280->15281 15282 a6b69e 15280->15282 15306 a6b0d1 EnterCriticalSection 15281->15306 15314 a6517e 15282->15314 15287 a6b6ad __onexit 15287->15264 15288 a6b6ed 15320 a6b714 15288->15320 15290 a6b6c1 15290->15288 15307 a6b5d6 15290->15307 15293 a69e26 15292->15293 15294 a69eb8 15292->15294 15293->15294 15295 a6b685 27 API calls 15293->15295 15298 a69ebf 15294->15298 15296 a69e4f 15295->15296 15296->15294 15297 a69e7d GetFileType 15296->15297 15297->15296 15299 a69ec6 15298->15299 15300 a69f09 GetStdHandle 15299->15300 15301 a69f71 15299->15301 15302 a69f1c GetFileType 15299->15302 15300->15299 15301->15270 15302->15299 15451 a6b121 LeaveCriticalSection 15303->15451 15305 a69fd4 15305->15268 15306->15290 15323 a6a272 15307->15323 15309 a6b5f5 15337 a68de9 15309->15337 15310 a6b5e8 15310->15309 15330 a6b3aa 15310->15330 15313 a6b647 15313->15290 15371 a68b29 GetLastError 15314->15371 15317 a64640 15429 a645c5 15317->15429 15319 a6464c 15319->15287 15450 a6b121 LeaveCriticalSection 15320->15450 15322 a6b71b 15322->15287 15329 a6a27f __dosmaperr 15323->15329 15324 a6a2bf 15326 a6517e __mbsinc 19 API calls 15324->15326 15325 a6a2aa RtlAllocateHeap 15325->15329 15327 a6a2bd 15326->15327 15327->15310 15329->15324 15329->15325 15329->15327 15343 a67f33 15329->15343 15358 a6b138 15330->15358 15332 a6b3d1 15333 a6b3ef InitializeCriticalSectionAndSpinCount 15332->15333 15336 a6b3da 15332->15336 15333->15336 15334 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15335 a6b406 15334->15335 15335->15310 15336->15334 15338 a68df4 HeapFree 15337->15338 15339 a68e1d _free 15337->15339 15338->15339 15340 a68e09 15338->15340 15339->15313 15341 a6517e __mbsinc 18 API calls 15340->15341 15342 a68e0f GetLastError 15341->15342 15342->15339 15348 a67f77 15343->15348 15345 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15347 a67f73 15345->15347 15346 a67f49 15346->15345 15347->15329 15349 a67f83 ___DestructExceptionObject 15348->15349 15354 a6b0d1 EnterCriticalSection 15349->15354 15351 a67f8e 15355 a67fc0 15351->15355 15353 a67fb5 __onexit 15353->15346 15354->15351 15356 a6b121 _abort LeaveCriticalSection 15355->15356 15357 a67fc7 15356->15357 15357->15353 15362 a6b164 15358->15362 15363 a6b168 __crt_fast_encode_pointer 15358->15363 15359 a6b188 15361 a6b194 GetProcAddress 15359->15361 15359->15363 15361->15363 15362->15359 15362->15363 15364 a6b1d4 15362->15364 15363->15332 15365 a6b1f5 LoadLibraryExW 15364->15365 15370 a6b1ea 15364->15370 15366 a6b212 GetLastError 15365->15366 15367 a6b22a 15365->15367 15366->15367 15369 a6b21d LoadLibraryExW 15366->15369 15368 a6b241 FreeLibrary 15367->15368 15367->15370 15368->15370 15369->15367 15370->15362 15372 a68b42 15371->15372 15373 a68b48 15371->15373 15390 a6b2fb 15372->15390 15375 a6a272 __dosmaperr 17 API calls 15373->15375 15377 a68b9f SetLastError 15373->15377 15376 a68b5a 15375->15376 15383 a68b62 15376->15383 15397 a6b351 15376->15397 15379 a65183 15377->15379 15379->15317 15381 a68de9 _free 17 API calls 15384 a68b68 15381->15384 15382 a68b7e 15404 a6890c 15382->15404 15383->15381 15386 a68b96 SetLastError 15384->15386 15386->15379 15388 a68de9 _free 17 API calls 15389 a68b8f 15388->15389 15389->15377 15389->15386 15391 a6b138 __dosmaperr 5 API calls 15390->15391 15392 a6b322 15391->15392 15393 a6b33a TlsGetValue 15392->15393 15394 a6b32e 15392->15394 15393->15394 15395 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15394->15395 15396 a6b34b 15395->15396 15396->15373 15398 a6b138 __dosmaperr 5 API calls 15397->15398 15399 a6b378 15398->15399 15400 a6b393 TlsSetValue 15399->15400 15403 a6b387 15399->15403 15400->15403 15401 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15402 a68b77 15401->15402 15402->15382 15402->15383 15403->15401 15409 a688e4 15404->15409 15415 a68824 15409->15415 15411 a68908 15412 a68894 15411->15412 15421 a68728 15412->15421 15414 a688b8 15414->15388 15416 a68830 ___DestructExceptionObject 15415->15416 15417 a6b0d1 _abort EnterCriticalSection 15416->15417 15418 a6883a 15417->15418 15419 a68860 __dosmaperr LeaveCriticalSection 15418->15419 15420 a68858 __onexit 15419->15420 15420->15411 15422 a68734 ___DestructExceptionObject 15421->15422 15423 a6b0d1 _abort EnterCriticalSection 15422->15423 15424 a6873e 15423->15424 15425 a68a5a __dosmaperr 20 API calls 15424->15425 15426 a68756 15425->15426 15427 a6876c __dosmaperr LeaveCriticalSection 15426->15427 15428 a68764 __onexit 15427->15428 15428->15414 15430 a68b29 __dosmaperr 20 API calls 15429->15430 15431 a645db 15430->15431 15432 a6463a 15431->15432 15435 a645e9 15431->15435 15440 a6466d IsProcessorFeaturePresent 15432->15440 15434 a6463f 15436 a645c5 __mbsinc 26 API calls 15434->15436 15438 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15435->15438 15437 a6464c 15436->15437 15437->15319 15439 a64610 15438->15439 15439->15319 15441 a64678 15440->15441 15444 a64476 15441->15444 15445 a64492 ___scrt_fastfail 15444->15445 15446 a644be IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15445->15446 15447 a6458f ___scrt_fastfail 15446->15447 15448 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15447->15448 15449 a645ad GetCurrentProcess TerminateProcess 15448->15449 15449->15434 15450->15322 15451->15305 15452->15277 15454 a64158 15453->15454 15456 a64132 15453->15456 15454->15191 15455 a64142 FreeLibrary 15455->15456 15456->15454 15456->15455 15458 a6122c GetStartupInfoW 15457->15458 15458->14738 15460 a533e0 ___scrt_fastfail 15459->15460 15461 a53653 15460->15461 15462 a5389f 15460->15462 15693 a52bb0 15460->15693 15461->15462 15463 a53669 15461->15463 15467 a5368b 15461->15467 15705 a53c10 15462->15705 15463->15467 15468 a52bb0 45 API calls 15463->15468 15465 a538a4 15469 a53c10 45 API calls 15465->15469 15466 a537aa 15471 a538ae 15466->15471 15479 a5382a 15466->15479 15467->15465 15467->15466 15478 a537db 15467->15478 15468->15467 15473 a538a9 15469->15473 15476 a64650 26 API calls 15471->15476 15472 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15474 a5389b 15472->15474 15475 a64650 26 API calls 15473->15475 15480 a57fe0 GetVersionExW 15474->15480 15475->15471 15477 a538b3 15476->15477 15478->15473 15478->15479 15479->15472 15481 a5800e 15480->15481 15482 a58049 GetLastError 15480->15482 15484 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15481->15484 15775 a57da0 15482->15775 15486 a554cb 15484->15486 15486->14744 15486->14745 15487 a6203a __CxxThrowException@8 RaiseException 15488 a58071 15487->15488 15490 a57f73 GetLastError 15489->15490 15491 a57eba GetTokenInformation 15489->15491 15492 a57da0 27 API calls 15490->15492 15780 a60ce3 15491->15780 15494 a57f87 15492->15494 15496 a6203a __CxxThrowException@8 RaiseException 15494->15496 15497 a57f95 GetLastError 15496->15497 15499 a57da0 27 API calls 15497->15499 15502 a57fa9 15499->15502 15500 a57fb7 GetLastError 15503 a57da0 27 API calls 15500->15503 15505 a6203a __CxxThrowException@8 RaiseException 15502->15505 15506 a57fcb 15503->15506 15505->15500 15508 a6203a __CxxThrowException@8 RaiseException 15506->15508 15510 a57fd9 15508->15510 15513 a580bf GetCurrentProcess 15512->15513 15514 a580ae 15512->15514 15517 a580e0 15513->15517 15515 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15514->15515 15516 a580bb 15515->15516 15516->14749 15518 a580e6 15517->15518 15519 a58101 GetLastError 15517->15519 15520 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15518->15520 15521 a57da0 27 API calls 15519->15521 15522 a580fd 15520->15522 15523 a58115 15521->15523 15522->14749 15524 a6203a __CxxThrowException@8 RaiseException 15523->15524 15525 a58123 15524->15525 15527 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15526->15527 15528 a53b68 CreateMutexW 15527->15528 15528->14761 15528->14762 15781 a5b0e0 15529->15781 15598 a511cd 15597->15598 15599 a511c2 SetForegroundWindow 15597->15599 15598->14763 15598->14790 15599->15598 15658 a54009 15657->15658 15659 a54013 15657->15659 16838 a64f49 15658->16838 15659->14841 15662 a65090 26 API calls 15661->15662 15663 a54813 15662->15663 15663->14872 15665 a541a6 15664->15665 15666 a54188 15664->15666 15665->14807 15666->15665 15667 a54199 Sleep 15666->15667 15667->15665 15667->15666 15694 a52d47 15693->15694 15697 a52be0 15693->15697 15720 a53c00 15694->15720 15698 a52c1a 15697->15698 15699 a52c4e 15697->15699 15710 a60bcf 15698->15710 15701 a52c38 15699->15701 15702 a60bcf 22 API calls 15699->15702 15703 a64650 26 API calls 15701->15703 15704 a52d15 15701->15704 15702->15701 15703->15694 15704->15460 15765 a605bd 15705->15765 15712 a60bd4 15710->15712 15713 a60bee 15712->15713 15714 a67f33 __dosmaperr 7 API calls 15712->15714 15716 a60bf0 15712->15716 15727 a65196 15712->15727 15713->15701 15714->15712 15715 a6151f 15717 a6203a __CxxThrowException@8 RaiseException 15715->15717 15716->15715 15736 a6203a 15716->15736 15718 a6153c 15717->15718 15739 a6059d 15720->15739 15728 a68e23 15727->15728 15729 a68e61 15728->15729 15731 a68e4c HeapAlloc 15728->15731 15734 a68e35 __dosmaperr 15728->15734 15730 a6517e __mbsinc 20 API calls 15729->15730 15733 a68e66 15730->15733 15732 a68e5f 15731->15732 15731->15734 15732->15733 15733->15712 15734->15729 15734->15731 15735 a67f33 __dosmaperr 7 API calls 15734->15735 15735->15734 15738 a6205a RaiseException 15736->15738 15738->15715 15744 a604eb 15739->15744 15742 a6203a __CxxThrowException@8 RaiseException 15743 a605bc 15742->15743 15747 a60493 15744->15747 15750 a62a76 15747->15750 15749 a604bf 15749->15742 15751 a62ab0 15750->15751 15752 a62a83 15750->15752 15751->15749 15752->15751 15753 a65196 ___std_exception_copy 21 API calls 15752->15753 15754 a62aa0 15753->15754 15754->15751 15756 a685fe 15754->15756 15757 a68619 15756->15757 15758 a6860b 15756->15758 15759 a6517e __mbsinc 20 API calls 15757->15759 15758->15757 15760 a68630 15758->15760 15764 a68621 15759->15764 15762 a6862b 15760->15762 15763 a6517e __mbsinc 20 API calls 15760->15763 15761 a64640 __mbsinc 26 API calls 15761->15762 15762->15751 15763->15764 15764->15761 15772 a6054b 15765->15772 15768 a6203a __CxxThrowException@8 RaiseException 15769 a605dc 15768->15769 15770 a57ae6 ___delayLoadHelper2@8 17 API calls 15769->15770 15771 a605f4 15770->15771 15773 a60493 std::exception::exception 27 API calls 15772->15773 15774 a6055d 15773->15774 15774->15768 15776 a62a76 ___std_exception_copy 27 API calls 15775->15776 15777 a57ddd 15776->15777 15778 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15777->15778 15779 a57df9 15778->15779 15779->15487 15866 a5b780 15781->15866 15784 a5b741 16091 a59da0 15784->16091 15785 a5b12c 15790 a5b780 39 API calls 15785->15790 15787 a5b74b 15788 a59da0 RaiseException 15787->15788 15789 a5b755 15788->15789 15791 a59da0 RaiseException 15789->15791 15792 a5b152 15790->15792 15793 a5b75f 15791->15793 15792->15787 15795 a5b15c 15792->15795 15794 a59da0 RaiseException 15793->15794 15796 a5b769 15794->15796 15801 a5b780 39 API calls 15795->15801 15797 a59da0 RaiseException 15796->15797 15798 a5b773 15797->15798 15799 a64650 26 API calls 15798->15799 15800 a5b778 15799->15800 15802 a64650 26 API calls 15800->15802 15803 a5b182 15801->15803 15804 a5b77d 15802->15804 15803->15789 15805 a5b18c 15803->15805 15806 a5b780 39 API calls 15805->15806 15807 a5b1b2 15806->15807 15807->15793 15808 a5b1bc 15807->15808 15881 a59530 15808->15881 15810 a5b1f2 15811 a5b780 39 API calls 15810->15811 15812 a5b20a 15811->15812 15812->15796 15813 a5b214 15812->15813 15952 a58dc0 15813->15952 15815 a5b24f 15970 a59450 CryptCreateHash 15815->15970 15818 a58dc0 35 API calls 15819 a5b287 15818->15819 15820 a59450 31 API calls 15819->15820 15821 a5b2a5 15820->15821 15981 a5c500 15821->15981 15867 a5b7b1 15866->15867 15878 a5b79d 15866->15878 16095 a60aca EnterCriticalSection 15867->16095 15869 a5b7bb 15871 a5b7c7 GetProcessHeap 15869->15871 15869->15878 15870 a60aca 5 API calls 15872 a5b81b 15870->15872 16100 a60f59 15871->16100 15875 a60f59 29 API calls 15872->15875 15880 a5b122 15872->15880 15877 a5b874 15875->15877 15879 a60a80 4 API calls 15877->15879 15878->15870 15878->15880 15879->15880 15880->15784 15880->15785 15882 a5b780 39 API calls 15881->15882 15883 a59566 15882->15883 15884 a59571 15883->15884 15885 a5981a 15883->15885 15890 a5b780 39 API calls 15884->15890 15886 a59da0 RaiseException 15885->15886 15887 a59824 15886->15887 15888 a59da0 RaiseException 15887->15888 15889 a5982e 15888->15889 15891 a59da0 RaiseException 15889->15891 15892 a59595 15890->15892 15893 a59838 15891->15893 15892->15887 15894 a595a0 15892->15894 15895 a59da0 RaiseException 15893->15895 15900 a5b780 39 API calls 15894->15900 15896 a59842 15895->15896 15897 a59da0 RaiseException 15896->15897 15898 a5984c 15897->15898 15899 a59da0 RaiseException 15898->15899 15901 a59856 15899->15901 15902 a595c4 15900->15902 15903 a59da0 RaiseException 15901->15903 15902->15889 15904 a595cf 15902->15904 15905 a59860 15903->15905 15910 a5b780 39 API calls 15904->15910 15906 a59da0 RaiseException 15905->15906 15907 a5986a 15906->15907 15908 a59da0 RaiseException 15907->15908 15909 a59874 15908->15909 15911 a59da0 RaiseException 15909->15911 15912 a595f3 15910->15912 15913 a5987e 15911->15913 15912->15893 15914 a595fe 15912->15914 15915 a59da0 RaiseException 15913->15915 15920 a5b780 39 API calls 15914->15920 15916 a59888 15915->15916 15917 a59da0 RaiseException 15916->15917 15918 a59892 15917->15918 15919 a59da0 RaiseException 15918->15919 15950 a597c9 15919->15950 15921 a59622 15920->15921 15921->15896 15923 a5962d 15921->15923 15922 a59da0 RaiseException 15924 a598a6 15922->15924 15925 a5b780 39 API calls 15923->15925 15924->15810 15926 a59651 15925->15926 15926->15898 15927 a5965c 15926->15927 15928 a5b780 39 API calls 15927->15928 15929 a59680 15928->15929 15929->15901 15930 a5968b 15929->15930 15931 a5b780 39 API calls 15930->15931 15932 a596af 15931->15932 15932->15905 15933 a596ba 15932->15933 15934 a5b780 39 API calls 15933->15934 15935 a596de 15934->15935 15935->15907 15936 a596e9 15935->15936 15937 a5b780 39 API calls 15936->15937 15938 a5970d 15937->15938 15938->15909 15939 a59718 15938->15939 15940 a5b780 39 API calls 15939->15940 15941 a5973c 15940->15941 15941->15913 15942 a59747 15941->15942 15943 a5b780 39 API calls 15942->15943 15944 a5976b 15943->15944 15944->15916 15945 a59776 15944->15945 15946 a5b780 39 API calls 15945->15946 15947 a5979a 15946->15947 15947->15918 15948 a597a5 15947->15948 15949 a5b780 39 API calls 15948->15949 15949->15950 15950->15922 15951 a597d4 15950->15951 15951->15810 15953 a58e3e ___scrt_fastfail 15952->15953 15954 a57fe0 30 API calls 15953->15954 15955 a58e46 15954->15955 15956 a58e4d lstrcatA 15955->15956 15957 a58e5c CryptAcquireContextA 15955->15957 15956->15957 15958 a58ea7 GetLastError 15957->15958 15959 a58e77 15957->15959 15960 a57da0 27 API calls 15958->15960 15961 a58e82 CryptReleaseContext 15959->15961 15962 a58e8b 15959->15962 15963 a58ebe 15960->15963 15961->15962 15964 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15962->15964 15966 a6203a __CxxThrowException@8 RaiseException 15963->15966 15965 a58ea3 15964->15965 15965->15815 15967 a58ecf 15966->15967 15968 a58ed6 CryptReleaseContext 15967->15968 15969 a58edf 15967->15969 15968->15969 15969->15815 15971 a5949f GetLastError 15970->15971 15972 a5947a 15970->15972 15975 a57da0 27 API calls 15971->15975 15973 a5948f 15972->15973 15974 a59488 CryptDestroyHash 15972->15974 15976 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 15973->15976 15974->15973 15977 a594b3 15975->15977 15978 a59499 15976->15978 15979 a6203a __CxxThrowException@8 RaiseException 15977->15979 15978->15818 15980 a594c1 15979->15980 15982 a5b780 39 API calls 15981->15982 15983 a5c53d 15982->15983 15984 a5c547 15983->15984 15985 a5c88c 15983->15985 15990 a5b780 39 API calls 15984->15990 15986 a59da0 RaiseException 15985->15986 15987 a5c896 15986->15987 15988 a59da0 RaiseException 15987->15988 15989 a5c8a0 15988->15989 15991 a59da0 RaiseException 15989->15991 15992 a5c56a 15990->15992 15993 a5c8aa 15991->15993 15992->15987 15994 a5c574 15992->15994 15995 a59da0 RaiseException 15993->15995 15997 a5b780 39 API calls 15994->15997 15996 a5c8b4 15995->15996 15998 a5c594 15997->15998 15998->15989 16000 a5c59e 15998->16000 15999 a5c5f7 GetSystemDirectoryW 16002 a5c607 GetLastError 15999->16002 16004 a5c614 15999->16004 16000->15999 16147 a5c920 16000->16147 16002->16004 16004->15993 16005 a5c677 GetVolumePathNameW 16004->16005 16007 a5c920 RaiseException 16004->16007 16008 a5c7fd 16004->16008 16006 a5c688 GetLastError 16005->16006 16013 a5c693 16005->16013 16006->16013 16009 a5c671 16007->16009 16010 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16008->16010 16009->16005 16011 a5b3f1 16010->16011 16027 a5a100 16011->16027 16012 a5c6e5 GetVolumeNameForVolumeMountPointW 16015 a5c6f6 GetLastError 16012->16015 16023 a5c701 16012->16023 16013->15993 16013->16008 16013->16012 16014 a5c920 RaiseException 16013->16014 16016 a5c6e2 16014->16016 16015->16023 16016->16012 16017 a5c79e CreateFileW 16018 a5c7c3 DeviceIoControl 16017->16018 16019 a5c7b8 GetLastError 16017->16019 16020 a5c7e3 GetLastError 16018->16020 16021 a5c7ee 16018->16021 16019->16008 16022 a5c7f6 CloseHandle 16020->16022 16021->16022 16022->16008 16023->15993 16023->16008 16023->16017 16024 a5c789 16023->16024 16025 a5c920 RaiseException 16023->16025 16024->15993 16026 a5c795 16024->16026 16025->16024 16026->16017 16028 a5b780 39 API calls 16027->16028 16029 a5a144 16028->16029 16030 a5a4b7 16029->16030 16031 a5a14e GetVersion 16029->16031 16032 a59da0 RaiseException 16030->16032 16166 a59ff0 16031->16166 16033 a5a4c1 16032->16033 16034 a59da0 RaiseException 16033->16034 16035 a5a4cb 16034->16035 16037 a59da0 RaiseException 16035->16037 16039 a5a4d5 16037->16039 16041 a5cc40 RaiseException 16039->16041 16040 a5a19a CreateFileW 16042 a5a1c7 16040->16042 16043 a5a1b9 GetLastError 16040->16043 16044 a5a4da 16041->16044 16045 a65196 ___std_exception_copy 21 API calls 16042->16045 16049 a5a46e 16043->16049 16046 a5a1d1 ___scrt_fastfail 16045->16046 16047 a5a1dd 16046->16047 16050 a5a1f6 DeviceIoControl 16046->16050 16048 a5a465 CloseHandle 16047->16048 16048->16049 16051 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16049->16051 16052 a5a22b GetLastError 16050->16052 16054 a5a239 16050->16054 16053 a5a4b3 16051->16053 16052->16048 16082 a5a4e0 16053->16082 16054->16047 16055 a5a41b 16054->16055 16058 a5a265 16054->16058 16056 a5a422 16055->16056 16057 a5a438 16055->16057 16059 a5cb70 27 API calls 16056->16059 16065 a5cb70 27 API calls 16057->16065 16060 a5b780 39 API calls 16058->16060 16061 a5a42e 16059->16061 16063 a5a26e 16060->16063 16064 a5cc50 43 API calls 16061->16064 16063->16033 16068 a5a279 16063->16068 16064->16047 16066 a5a454 16065->16066 16067 a5cc50 43 API calls 16066->16067 16067->16047 16068->16035 16069 a5a2bb 16068->16069 16179 a5c8c0 16068->16179 16183 a5cdd0 16069->16183 16072 a5a2cc 16072->16035 16073 a5a2fa 16072->16073 16074 a5a3d7 16073->16074 16077 a5a35a 16073->16077 16078 a5a334 16073->16078 16213 a5cb70 16074->16213 16079 a5a39e 16077->16079 16078->16039 16078->16077 16080 a5a385 16078->16080 16079->16077 16235 a5cc50 16079->16235 16193 a5cfb0 16080->16193 16083 a5b780 39 API calls 16082->16083 16084 a5a523 16083->16084 16085 a59da0 RaiseException 16084->16085 16086 a5a8e1 16085->16086 16087 a59da0 RaiseException 16086->16087 16088 a5a8eb 16087->16088 16089 a5cc40 RaiseException 16088->16089 16090 a5a8f0 16089->16090 16092 a59daf 16091->16092 16093 a6203a __CxxThrowException@8 RaiseException 16092->16093 16094 a59dbd 16093->16094 16094->15787 16099 a60ade 16095->16099 16096 a60ae3 LeaveCriticalSection 16096->15869 16099->16096 16107 a60b5e 16099->16107 16110 a60f1e 16100->16110 16103 a60a80 EnterCriticalSection LeaveCriticalSection 16104 a60b1c 16103->16104 16105 a60b25 16104->16105 16106 a60b4a SetEvent ResetEvent 16104->16106 16105->15878 16106->15878 16108 a60b97 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 16107->16108 16109 a60b6b 16107->16109 16108->16109 16109->16099 16111 a60f42 16110->16111 16112 a60f3b 16110->16112 16119 a6838c 16111->16119 16116 a6831c 16112->16116 16115 a5b802 16115->16103 16117 a6838c __onexit 29 API calls 16116->16117 16118 a6832e 16117->16118 16118->16115 16122 a68093 16119->16122 16125 a67fc9 16122->16125 16124 a680b7 16124->16115 16126 a67fd5 ___DestructExceptionObject 16125->16126 16133 a6b0d1 EnterCriticalSection 16126->16133 16128 a67fe3 16134 a681db 16128->16134 16130 a67ff0 16144 a6800e 16130->16144 16132 a68001 __onexit 16132->16124 16133->16128 16135 a681f9 16134->16135 16142 a681f1 __onexit __crt_fast_encode_pointer 16134->16142 16136 a68252 16135->16136 16137 a68586 __onexit 29 API calls 16135->16137 16135->16142 16138 a68586 __onexit 29 API calls 16136->16138 16136->16142 16139 a68248 16137->16139 16140 a68268 16138->16140 16141 a68de9 _free 20 API calls 16139->16141 16143 a68de9 _free 20 API calls 16140->16143 16141->16136 16142->16130 16143->16142 16145 a6b121 _abort LeaveCriticalSection 16144->16145 16146 a68018 16145->16146 16146->16132 16148 a5c939 16147->16148 16152 a5c947 16147->16152 16154 a59f40 16148->16154 16150 a5c5f4 16150->15999 16152->16150 16158 a5c9d0 16152->16158 16155 a59f69 16154->16155 16163 a5cc40 16155->16163 16159 a5c9e3 16158->16159 16160 a5cc40 RaiseException 16159->16160 16161 a5ca06 16159->16161 16162 a5ca15 16160->16162 16161->16150 16162->16150 16164 a59da0 RaiseException 16163->16164 16165 a5cc4a 16164->16165 16167 a5a005 ___scrt_initialize_default_local_stdio_options 16166->16167 16177 a5a071 16166->16177 16263 a6706b 16167->16263 16168 a59da0 RaiseException 16169 a5a097 16168->16169 16170 a59da0 RaiseException 16169->16170 16172 a5a0a1 16170->16172 16172->16040 16174 a5a054 16266 a6708f 16174->16266 16175 a5c920 RaiseException 16175->16174 16177->16168 16178 a5a07b 16177->16178 16178->16040 16181 a5c8e7 16179->16181 16180 a5c913 16180->16069 16181->16180 16545 a5c980 16181->16545 16188 a5cde8 16183->16188 16185 a5ce96 16187 a652a8 42 API calls 16185->16187 16192 a5cf12 16185->16192 16187->16185 16188->16185 16191 a5ce64 16188->16191 16550 a655d7 16188->16550 16554 a652a8 16188->16554 16559 a65279 16188->16559 16190 a65279 42 API calls 16190->16191 16191->16185 16191->16190 16192->16072 16194 a5cfc0 16193->16194 16195 a5cfbb 16193->16195 16196 a5cfc7 16194->16196 16200 a5cfdf ___scrt_fastfail 16194->16200 16195->16079 16197 a6517e __mbsinc 20 API calls 16196->16197 16198 a5cfcc 16197->16198 16201 a64640 __mbsinc 26 API calls 16198->16201 16199 a5cfef 16199->16079 16200->16199 16202 a5d011 16200->16202 16203 a5d02b 16200->16203 16204 a5cfd7 16201->16204 16205 a6517e __mbsinc 20 API calls 16202->16205 16206 a5d021 16203->16206 16208 a6517e __mbsinc 20 API calls 16203->16208 16204->16079 16207 a5d016 16205->16207 16206->16079 16209 a64640 __mbsinc 26 API calls 16207->16209 16210 a5d034 16208->16210 16209->16206 16211 a64640 __mbsinc 26 API calls 16210->16211 16212 a5d03f 16211->16212 16212->16079 16214 a5cb81 16213->16214 16219 a5cb8e 16213->16219 16634 a59dd0 16214->16634 16216 a59da0 RaiseException 16218 a5cc3f 16216->16218 16220 a5cbca 16219->16220 16221 a5c8c0 RaiseException 16219->16221 16227 a5cbe8 BuildCatchObjectHelperInternal 16219->16227 16222 a5cbd4 16220->16222 16223 a5cc0e 16220->16223 16221->16220 16225 a5cbd8 16222->16225 16226 a5cbea 16222->16226 16224 a5cfb0 26 API calls 16223->16224 16224->16227 16228 a6517e __mbsinc 20 API calls 16225->16228 16226->16227 16229 a6517e __mbsinc 20 API calls 16226->16229 16227->16216 16233 a5cc24 16227->16233 16230 a5cbdd 16228->16230 16232 a5cbf4 16229->16232 16231 a64640 __mbsinc 26 API calls 16230->16231 16231->16227 16234 a64640 __mbsinc 26 API calls 16232->16234 16233->16077 16234->16227 16236 a5ccb7 16235->16236 16239 a5cc5f 16235->16239 16238 a67266 42 API calls 16236->16238 16256 a5cd88 16236->16256 16242 a5ccdd 16238->16242 16247 a5cc8e 16239->16247 16639 a67266 16239->16639 16642 a671c2 16239->16642 16240 a671c2 __mbsinc 38 API calls 16240->16242 16242->16240 16243 a67266 42 API calls 16242->16243 16245 a5ccfc 16242->16245 16243->16242 16244 a59da0 RaiseException 16248 a5cdaf 16244->16248 16246 a5cd27 16245->16246 16249 a5c8c0 RaiseException 16245->16249 16245->16256 16260 a5cd96 16245->16260 16250 a5cd53 16246->16250 16251 a5cd3c 16246->16251 16261 a5cd4c BuildCatchObjectHelperInternal 16246->16261 16247->16236 16247->16256 16259 a5c8c0 RaiseException 16247->16259 16249->16246 16255 a6517e __mbsinc 20 API calls 16250->16255 16250->16261 16253 a6517e __mbsinc 20 API calls 16251->16253 16254 a5cd41 16253->16254 16257 a64640 __mbsinc 26 API calls 16254->16257 16258 a5cd60 16255->16258 16256->16244 16256->16260 16257->16261 16262 a64640 __mbsinc 26 API calls 16258->16262 16259->16236 16260->16047 16650 a59d00 16261->16650 16262->16261 16269 a65bc9 16263->16269 16491 a65d4e 16266->16491 16268 a670ae 16268->16177 16270 a65bf1 16269->16270 16271 a65c09 16269->16271 16272 a6517e __mbsinc 20 API calls 16270->16272 16271->16270 16273 a65c11 16271->16273 16274 a65bf6 16272->16274 16286 a64dd3 16273->16286 16276 a64640 __mbsinc 26 API calls 16274->16276 16284 a65c01 16276->16284 16278 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16281 a5a026 16278->16281 16281->16169 16281->16174 16281->16175 16284->16278 16287 a64df0 16286->16287 16293 a64de6 16286->16293 16287->16293 16314 a68aa5 GetLastError 16287->16314 16289 a64e11 16334 a68d51 16289->16334 16294 a66089 16293->16294 16295 a660a8 16294->16295 16296 a6517e __mbsinc 20 API calls 16295->16296 16297 a65c99 16296->16297 16298 a663a8 16297->16298 16374 a64e82 16298->16374 16300 a663cd 16301 a6517e __mbsinc 20 API calls 16300->16301 16302 a663d2 16301->16302 16304 a64640 __mbsinc 26 API calls 16302->16304 16303 a65ca4 16311 a660be 16303->16311 16304->16303 16305 a663b8 16305->16300 16305->16303 16381 a66505 16305->16381 16388 a66941 16305->16388 16393 a6653f 16305->16393 16398 a66568 16305->16398 16429 a666e4 16305->16429 16312 a68de9 _free 20 API calls 16311->16312 16313 a660ce 16312->16313 16313->16284 16315 a68ac1 16314->16315 16316 a68abb 16314->16316 16318 a6a272 __dosmaperr 20 API calls 16315->16318 16319 a68b10 SetLastError 16315->16319 16317 a6b2fb __dosmaperr 11 API calls 16316->16317 16317->16315 16320 a68ad3 16318->16320 16319->16289 16321 a68adb 16320->16321 16322 a6b351 __dosmaperr 11 API calls 16320->16322 16324 a68de9 _free 20 API calls 16321->16324 16323 a68af0 16322->16323 16323->16321 16325 a68af7 16323->16325 16326 a68ae1 16324->16326 16328 a6890c __dosmaperr 20 API calls 16325->16328 16327 a68b1c SetLastError 16326->16327 16342 a68658 16327->16342 16329 a68b02 16328->16329 16331 a68de9 _free 20 API calls 16329->16331 16333 a68b09 16331->16333 16333->16319 16333->16327 16335 a68d64 16334->16335 16336 a64e2a 16334->16336 16335->16336 16353 a6bdf4 16335->16353 16338 a68d7e 16336->16338 16339 a68d91 16338->16339 16340 a68da6 16338->16340 16339->16340 16365 a6acee 16339->16365 16340->16293 16343 a6c0a6 _abort EnterCriticalSection LeaveCriticalSection 16342->16343 16344 a6865d 16343->16344 16345 a6c101 _abort 37 API calls 16344->16345 16347 a68668 16344->16347 16345->16347 16346 a68672 IsProcessorFeaturePresent 16348 a6867d 16346->16348 16347->16346 16352 a68690 16347->16352 16350 a64476 _abort 8 API calls 16348->16350 16349 a67d76 _abort 28 API calls 16351 a6869a 16349->16351 16350->16352 16352->16349 16354 a6be00 ___DestructExceptionObject 16353->16354 16355 a68aa5 FindHandler 38 API calls 16354->16355 16356 a6be09 16355->16356 16357 a6b0d1 _abort EnterCriticalSection 16356->16357 16364 a6be57 __onexit 16356->16364 16358 a6be27 16357->16358 16359 a6be6b __fassign 20 API calls 16358->16359 16360 a6be3b 16359->16360 16361 a6be5a __fassign LeaveCriticalSection 16360->16361 16362 a6be4e 16361->16362 16363 a68658 _abort 38 API calls 16362->16363 16362->16364 16363->16364 16364->16336 16366 a6acfa ___DestructExceptionObject 16365->16366 16367 a68aa5 FindHandler 38 API calls 16366->16367 16372 a6ad04 16367->16372 16368 a6b0d1 _abort EnterCriticalSection 16368->16372 16369 a6ad88 __onexit 16369->16340 16370 a68658 _abort 38 API calls 16370->16372 16371 a6ad7f __fassign LeaveCriticalSection 16371->16372 16372->16368 16372->16369 16372->16370 16372->16371 16373 a68de9 _free 20 API calls 16372->16373 16373->16372 16375 a64e87 16374->16375 16376 a64e9a 16374->16376 16377 a6517e __mbsinc 20 API calls 16375->16377 16376->16305 16378 a64e8c 16377->16378 16379 a64640 __mbsinc 26 API calls 16378->16379 16380 a64e97 16379->16380 16380->16305 16382 a6650a 16381->16382 16383 a66521 16382->16383 16384 a6517e __mbsinc 20 API calls 16382->16384 16383->16305 16385 a66513 16384->16385 16386 a64640 __mbsinc 26 API calls 16385->16386 16387 a6651e 16386->16387 16387->16305 16389 a66952 16388->16389 16390 a66948 16388->16390 16389->16305 16453 a6621a 16390->16453 16394 a66546 16393->16394 16395 a66550 16393->16395 16396 a6621a 39 API calls 16394->16396 16395->16305 16397 a6654f 16396->16397 16397->16305 16399 a66571 16398->16399 16400 a6658b 16398->16400 16402 a665bc 16399->16402 16403 a66776 16399->16403 16404 a6670b 16399->16404 16401 a6517e __mbsinc 20 API calls 16400->16401 16400->16402 16405 a665a8 16401->16405 16402->16305 16407 a667bc 16403->16407 16408 a6677d 16403->16408 16416 a6674d 16403->16416 16413 a66717 16404->16413 16404->16416 16406 a64640 __mbsinc 26 API calls 16405->16406 16410 a665b3 16406->16410 16484 a66e13 16407->16484 16411 a66782 16408->16411 16412 a66724 16408->16412 16410->16305 16411->16416 16419 a66787 16411->16419 16418 a66746 16412->16418 16427 a66732 16412->16427 16476 a66a2c 16412->16476 16413->16412 16417 a6675d 16413->16417 16413->16427 16416->16418 16416->16427 16470 a66c36 16416->16470 16417->16418 16456 a66b9e 16417->16456 16423 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16418->16423 16420 a6678c 16419->16420 16421 a6679a 16419->16421 16420->16418 16460 a66df4 16420->16460 16464 a66d80 16421->16464 16426 a6693d 16423->16426 16426->16305 16427->16418 16487 a66f46 16427->16487 16430 a66776 16429->16430 16431 a6670b 16429->16431 16432 a667bc 16430->16432 16433 a6677d 16430->16433 16440 a6674d 16430->16440 16436 a66717 16431->16436 16431->16440 16435 a66e13 26 API calls 16432->16435 16434 a66782 16433->16434 16444 a66724 16433->16444 16439 a66787 16434->16439 16434->16440 16450 a66732 16435->16450 16441 a6675d 16436->16441 16436->16444 16436->16450 16437 a66c36 26 API calls 16437->16450 16438 a66a2c 48 API calls 16438->16450 16442 a6678c 16439->16442 16443 a6679a 16439->16443 16440->16437 16440->16450 16452 a66746 16440->16452 16447 a66b9e 40 API calls 16441->16447 16441->16452 16448 a66df4 26 API calls 16442->16448 16442->16452 16445 a66d80 26 API calls 16443->16445 16444->16438 16444->16450 16444->16452 16445->16450 16446 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16449 a6693d 16446->16449 16447->16450 16448->16450 16449->16305 16451 a66f46 40 API calls 16450->16451 16450->16452 16451->16452 16452->16446 16454 a69132 39 API calls 16453->16454 16455 a66243 16454->16455 16455->16305 16457 a66bca 16456->16457 16458 a6915e __fassign 40 API calls 16457->16458 16459 a66bf9 16457->16459 16458->16459 16459->16427 16461 a66e00 16460->16461 16462 a66c36 26 API calls 16461->16462 16463 a66e12 16462->16463 16463->16427 16469 a66d95 16464->16469 16465 a6517e __mbsinc 20 API calls 16466 a66d9e 16465->16466 16467 a64640 __mbsinc 26 API calls 16466->16467 16468 a66da9 16467->16468 16468->16427 16469->16465 16469->16468 16471 a66c47 16470->16471 16472 a6517e __mbsinc 20 API calls 16471->16472 16475 a66c71 16471->16475 16473 a66c66 16472->16473 16474 a64640 __mbsinc 26 API calls 16473->16474 16474->16475 16475->16427 16477 a66a48 16476->16477 16478 a65de0 21 API calls 16477->16478 16479 a66a95 16478->16479 16480 a69b3d 40 API calls 16479->16480 16481 a66b0f 16480->16481 16482 a661be 46 API calls 16481->16482 16483 a66b2e 16481->16483 16482->16483 16483->16427 16483->16483 16485 a66c36 26 API calls 16484->16485 16486 a66e2a 16485->16486 16486->16427 16489 a66f58 16487->16489 16490 a66fa6 16487->16490 16488 a6915e __fassign 40 API calls 16488->16489 16489->16488 16489->16490 16490->16418 16492 a65d6e 16491->16492 16493 a65d59 16491->16493 16494 a65db2 16492->16494 16496 a65d7c 16492->16496 16495 a6517e __mbsinc 20 API calls 16493->16495 16497 a6517e __mbsinc 20 API calls 16494->16497 16498 a65d5e 16495->16498 16507 a65a44 16496->16507 16500 a65daa 16497->16500 16501 a64640 __mbsinc 26 API calls 16498->16501 16504 a64640 __mbsinc 26 API calls 16500->16504 16503 a65d69 16501->16503 16503->16268 16505 a65dc2 16504->16505 16505->16268 16506 a6517e __mbsinc 20 API calls 16506->16500 16508 a65a84 16507->16508 16509 a65a6c 16507->16509 16508->16509 16511 a65a8c 16508->16511 16510 a6517e __mbsinc 20 API calls 16509->16510 16512 a65a71 16510->16512 16513 a64dd3 __fassign 38 API calls 16511->16513 16514 a64640 __mbsinc 26 API calls 16512->16514 16515 a65a9c 16513->16515 16523 a65a7c 16514->16523 16516 a66089 20 API calls 16515->16516 16518 a65b14 16516->16518 16517 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16519 a65ba6 16517->16519 16524 a66278 16518->16524 16519->16505 16519->16506 16521 a660be 20 API calls 16521->16523 16523->16517 16525 a64e82 26 API calls 16524->16525 16532 a66288 16525->16532 16526 a6629d 16527 a6517e __mbsinc 20 API calls 16526->16527 16528 a662a2 16527->16528 16530 a64640 __mbsinc 26 API calls 16528->16530 16529 a65b1f 16529->16521 16530->16529 16532->16526 16532->16529 16533 a66941 39 API calls 16532->16533 16534 a6653f 39 API calls 16532->16534 16535 a66568 50 API calls 16532->16535 16536 a66505 26 API calls 16532->16536 16537 a666e4 50 API calls 16532->16537 16538 a66edf 16532->16538 16533->16532 16534->16532 16535->16532 16536->16532 16537->16532 16539 a66ee5 16538->16539 16540 a66efe 16538->16540 16539->16540 16541 a6517e __mbsinc 20 API calls 16539->16541 16540->16532 16542 a66ef0 16541->16542 16543 a64640 __mbsinc 26 API calls 16542->16543 16544 a66efb 16543->16544 16544->16532 16547 a5c993 16545->16547 16546 a5cc40 RaiseException 16548 a5c9c5 16546->16548 16547->16546 16549 a5c9b6 16547->16549 16549->16180 16551 a655e5 16550->16551 16552 a655ef 16550->16552 16564 a655a3 16551->16564 16552->16188 16555 a652b6 16554->16555 16556 a652c4 16554->16556 16624 a65214 16555->16624 16556->16188 16560 a65287 16559->16560 16561 a65295 16559->16561 16629 a651d9 16560->16629 16561->16188 16567 a6541f 16564->16567 16568 a64dd3 __fassign 38 API calls 16567->16568 16569 a65433 16568->16569 16570 a6543e 16569->16570 16571 a65489 16569->16571 16579 a65586 16570->16579 16572 a654b0 16571->16572 16582 a68e71 16571->16582 16575 a6517e __mbsinc 20 API calls 16572->16575 16576 a654b6 16572->16576 16575->16576 16585 a690c7 16576->16585 16578 a65448 16578->16552 16590 a64ec7 16579->16590 16583 a64dd3 __fassign 38 API calls 16582->16583 16584 a68e84 16583->16584 16584->16572 16586 a64dd3 __fassign 38 API calls 16585->16586 16587 a690da 16586->16587 16597 a68eaa 16587->16597 16591 a64ed3 16590->16591 16592 a64ee9 16590->16592 16591->16592 16594 a64edb 16591->16594 16593 a64e9d 38 API calls 16592->16593 16596 a64ee7 16593->16596 16595 a68c7f 42 API calls 16594->16595 16595->16596 16596->16578 16598 a68ec5 16597->16598 16599 a68eeb MultiByteToWideChar 16598->16599 16600 a68f15 16599->16600 16601 a6909f 16599->16601 16604 a68e23 __onexit 21 API calls 16600->16604 16606 a68f36 __alloca_probe_16 16600->16606 16602 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16601->16602 16603 a690b2 16602->16603 16603->16578 16604->16606 16605 a68f7f MultiByteToWideChar 16607 a68f98 16605->16607 16623 a68feb 16605->16623 16606->16605 16606->16623 16608 a6b40c 11 API calls 16607->16608 16610 a68faf 16608->16610 16609 a69112 __freea 20 API calls 16609->16601 16611 a68fc2 16610->16611 16612 a68ffa 16610->16612 16610->16623 16614 a6b40c 11 API calls 16611->16614 16611->16623 16615 a68e23 __onexit 21 API calls 16612->16615 16619 a6901b __alloca_probe_16 16612->16619 16613 a69090 16617 a69112 __freea 20 API calls 16613->16617 16614->16623 16615->16619 16616 a6b40c 11 API calls 16618 a6906f 16616->16618 16617->16623 16618->16613 16620 a6907e WideCharToMultiByte 16618->16620 16619->16613 16619->16616 16620->16613 16621 a690be 16620->16621 16622 a69112 __freea 20 API calls 16621->16622 16622->16623 16623->16609 16625 a64dd3 __fassign 38 API calls 16624->16625 16626 a65227 16625->16626 16627 a64ec7 42 API calls 16626->16627 16628 a65235 16627->16628 16628->16188 16630 a64dd3 __fassign 38 API calls 16629->16630 16631 a651ec 16630->16631 16632 a64ec7 42 API calls 16631->16632 16633 a651fd 16632->16633 16633->16188 16635 a59e08 16634->16635 16636 a59e17 16634->16636 16635->16636 16637 a59da0 RaiseException 16635->16637 16636->16077 16638 a59e8a 16637->16638 16659 a67279 16639->16659 16643 a671e3 16642->16643 16644 a671cf 16642->16644 16696 a6a065 16643->16696 16646 a6517e __mbsinc 20 API calls 16644->16646 16647 a671d4 16646->16647 16648 a64640 __mbsinc 26 API calls 16647->16648 16649 a671df 16648->16649 16649->16239 16651 a59d0b 16650->16651 16652 a59d27 16651->16652 16653 a59d31 16651->16653 16654 a59d19 16651->16654 16655 a59da0 RaiseException 16651->16655 16656 a59da0 RaiseException 16652->16656 16657 a59da0 RaiseException 16653->16657 16654->16256 16655->16652 16656->16653 16658 a59d3b 16657->16658 16660 a64dd3 __fassign 38 API calls 16659->16660 16661 a6728c 16660->16661 16662 a672a8 16661->16662 16663 a67298 16661->16663 16667 a671fd 16662->16667 16664 a64ec7 42 API calls 16663->16664 16666 a67275 16664->16666 16666->16239 16668 a67215 16667->16668 16670 a67211 16667->16670 16671 a6a07d 16668->16671 16670->16666 16672 a64dd3 __fassign 38 API calls 16671->16672 16673 a6a09d MultiByteToWideChar 16672->16673 16675 a6a0db 16673->16675 16683 a6a173 16673->16683 16677 a6a0fc __alloca_probe_16 ___scrt_fastfail 16675->16677 16685 a68e23 16675->16685 16676 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16679 a6a196 16676->16679 16680 a6a16d 16677->16680 16682 a6a141 MultiByteToWideChar 16677->16682 16679->16670 16692 a69112 16680->16692 16682->16680 16684 a6a15d GetStringTypeW 16682->16684 16683->16676 16684->16680 16686 a68e61 16685->16686 16691 a68e31 __dosmaperr 16685->16691 16687 a6517e __mbsinc 20 API calls 16686->16687 16689 a68e5f 16687->16689 16688 a68e4c HeapAlloc 16688->16689 16688->16691 16689->16677 16690 a67f33 __dosmaperr 7 API calls 16690->16691 16691->16686 16691->16688 16691->16690 16693 a6912f 16692->16693 16694 a6911e 16692->16694 16693->16683 16694->16693 16695 a68de9 _free 20 API calls 16694->16695 16695->16693 16699 a6a00c 16696->16699 16700 a64dd3 __fassign 38 API calls 16699->16700 16701 a6a020 16700->16701 16701->16649 16839 a64f56 16838->16839 16840 a6517e __mbsinc 20 API calls 16839->16840 16841 a64f65 16839->16841 16842 a64f5b 16840->16842 16841->15659 16843 a64640 __mbsinc 26 API calls 16842->16843 16843->16841 16845 a67b4d FindHandler 16844->16845 16846 a67b65 16845->16846 16866 a67c9b GetModuleHandleW 16845->16866 16875 a6b0d1 EnterCriticalSection 16846->16875 16853 a67b6d 16861 a67c0b 16853->16861 16863 a67be2 16853->16863 16876 a68332 16853->16876 16854 a67c54 16890 a71b19 16854->16890 16855 a67c28 16882 a67c5a 16855->16882 16856 a67a8d _abort 5 API calls 16856->16861 16860 a67a8d _abort 5 API calls 16865 a67bfa 16860->16865 16879 a67c4b 16861->16879 16863->16860 16863->16865 16865->16856 16867 a67b59 16866->16867 16867->16846 16868 a67cdf GetModuleHandleExW 16867->16868 16869 a67d1e 16868->16869 16870 a67d09 GetProcAddress 16868->16870 16871 a67d32 FreeLibrary 16869->16871 16872 a67d3b 16869->16872 16870->16869 16871->16872 16873 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16872->16873 16874 a67d45 16873->16874 16874->16846 16875->16853 16893 a6806b 16876->16893 16915 a6b121 LeaveCriticalSection 16879->16915 16881 a67c24 16881->16854 16881->16855 16916 a6b516 16882->16916 16885 a67c88 16888 a67cdf _abort 8 API calls 16885->16888 16886 a67c68 GetPEB 16886->16885 16887 a67c78 GetCurrentProcess TerminateProcess 16886->16887 16887->16885 16889 a67c90 ExitProcess 16888->16889 16891 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16890->16891 16892 a71b24 16891->16892 16892->16892 16896 a6801a 16893->16896 16895 a6808f 16895->16863 16897 a68026 ___DestructExceptionObject 16896->16897 16904 a6b0d1 EnterCriticalSection 16897->16904 16899 a68034 16905 a680bb 16899->16905 16903 a68052 __onexit 16903->16895 16904->16899 16906 a680e3 16905->16906 16907 a680db 16905->16907 16906->16907 16910 a68de9 _free 20 API calls 16906->16910 16908 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16907->16908 16909 a68041 16908->16909 16911 a6805f 16909->16911 16910->16907 16914 a6b121 LeaveCriticalSection 16911->16914 16913 a68069 16913->16903 16914->16913 16915->16881 16917 a6b531 16916->16917 16918 a6b53b 16916->16918 16920 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16917->16920 16919 a6b138 __dosmaperr 5 API calls 16918->16919 16919->16917 16921 a67c64 16920->16921 16921->16885 16921->16886 16925 a6bf6d 16922->16925 16926 a6bf86 16925->16926 16927 a60bbe __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 16926->16927 16928 a60f10 16927->16928 16928->15165

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00A552F0 Relevance: 229.8, APIs: 95, Strings: 35, Instructions: 2278synchronizationfileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • InterlockedExchange.KERNEL32(?,00000103), ref: 00A5548F
                                                                                                                                                                                                                                                • Part of subcall function 00A57FE0: GetVersionExW.KERNEL32(?), ref: 00A58004
                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 00A554D6
                                                                                                                                                                                                                                                • Part of subcall function 00A57E70: OpenProcessToken.ADVAPI32(00A554E2,00000008,?,08BFF329,?,00000000), ref: 00A57EAC
                                                                                                                                                                                                                                                • Part of subcall function 00A57E70: GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00A720C0), ref: 00A57ED9
                                                                                                                                                                                                                                                • Part of subcall function 00A57E70: GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00A57F15
                                                                                                                                                                                                                                                • Part of subcall function 00A57E70: IsValidSid.ADVAPI32 ref: 00A57F22
                                                                                                                                                                                                                                                • Part of subcall function 00A57E70: GetSidSubAuthorityCount.ADVAPI32 ref: 00A57F31
                                                                                                                                                                                                                                                • Part of subcall function 00A57E70: GetSidSubAuthority.ADVAPI32(?,?), ref: 00A57F3D
                                                                                                                                                                                                                                                • Part of subcall function 00A57E70: CloseHandle.KERNELBASE(00000000), ref: 00A57F4F
                                                                                                                                                                                                                                              • InterlockedExchange.KERNEL32(?,0000052F), ref: 00A554FC
                                                                                                                                                                                                                                              • InterlockedExchange.KERNEL32(?,00000000), ref: 00A5550A
                                                                                                                                                                                                                                              • InterlockedExchange.KERNEL32(?,000000C1), ref: 00A55593
                                                                                                                                                                                                                                              • InterlockedExchange.KERNEL32(?,00000000), ref: 00A555A2
                                                                                                                                                                                                                                              • CreateMutexW.KERNELBASE(00000000,00000001,00000000), ref: 00A555D9
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00A555E9
                                                                                                                                                                                                                                              • InterlockedExchange.KERNEL32(?,00000420), ref: 00A55602
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A575E3
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A575F4
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A57605
                                                                                                                                                                                                                                              • _wcsrchr.LIBVCRUNTIME ref: 00A576A1
                                                                                                                                                                                                                                              • _wcsrchr.LIBVCRUNTIME ref: 00A576B3
                                                                                                                                                                                                                                              • CreateHardLinkW.KERNEL32(?,00000000,00000000), ref: 00A576EF
                                                                                                                                                                                                                                              • CopyFileW.KERNEL32(00000000,?,00000000), ref: 00A57707
                                                                                                                                                                                                                                              • ReleaseMutex.KERNEL32(?), ref: 00A57718
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A5771F
                                                                                                                                                                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00A57817
                                                                                                                                                                                                                                                • Part of subcall function 00A53B70: #17.COMCTL32 ref: 00A53B84
                                                                                                                                                                                                                                                • Part of subcall function 00A53B70: LoadStringW.USER32(00A50000,000003E9,?,00000000), ref: 00A53BA1
                                                                                                                                                                                                                                                • Part of subcall function 00A53B70: LoadStringW.USER32(00A50000,?,?,00000000), ref: 00A53BBA
                                                                                                                                                                                                                                                • Part of subcall function 00A53B70: MessageBoxExW.USER32(00000000,00000000,00000000,00000010,00000409), ref: 00A53BCF
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExchangeInterlocked$CloseHandle$LoadToken$AuthorityCreateInformationMutexProcessString_wcsrchr$CopyCountCurrentErrorFileHardHelper2@8LastLinkMessageOpenReleaseValidVersion___delay
                                                                                                                                                                                                                                              • String ID: $ /cookie:$ /edat_dir:$ /ga_clientid:$ /sub_edition:$%s\%s$/cookie$/cust_ini$/ppi_icd$/silent$/smbupd$AuthorizationType$Avast One$D$Enabled$Password$Port$Properties$ProxySettings$ProxyType$User$User-Agent: avast! Antivirus (instup)$allow_fallback$avcfg://settings/Common/VersionSwitch$count$enable$http://$https://$installer.exe$mirror$server0$servers$stable$urlpgm${versionSwitch}
                                                                                                                                                                                                                                              • API String ID: 1722064709-657827273
                                                                                                                                                                                                                                              • Opcode ID: 1aec63d7d76b4ed46c7de15533b7f4abee37d2cbcda97168fc6becc08e8980c8
                                                                                                                                                                                                                                              • Instruction ID: 6d754cba8a36d91bab1564b50cadf0d52c53485c046bc038965d71a429640333
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1aec63d7d76b4ed46c7de15533b7f4abee37d2cbcda97168fc6becc08e8980c8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D236B72E012289AEF20DB64CD45BEDB7B8BF45305F5081D9E909A7182EB709BC9CF51
                                                                                                                                                                                                                                              Function 00A5BB70 Relevance: 39.3, APIs: 13, Strings: 9, Instructions: 777filelibraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 731 a5bb70-a5bbdd GetVersion 732 a5bbdf-a5bbe6 731->732 733 a5bbe8-a5bbf0 731->733 734 a5bc58-a5bc92 call a65191 * 3 call a60bbe 732->734 735 a5bcf5-a5bd2c GetModuleHandleW GetProcAddress 733->735 736 a5bbf6-a5bc11 GetModuleHandleW GetProcAddress 733->736 739 a5bd32-a5bd71 735->739 740 a5bf1a 735->740 736->734 737 a5bc13-a5bc2c GetSystemFirmwareTable 736->737 747 a5bc55 737->747 748 a5bc2e-a5bc4c call a65196 737->748 739->740 758 a5bd77-a5bd95 MapViewOfFile 739->758 742 a5bf1c 740->742 745 a5bf21-a5bf2d 742->745 750 a5bf2f-a5bf36 CloseHandle 745->750 751 a5bf39-a5bf3b 745->751 747->734 766 a5bc93-a5bcbd call a61ee0 GetSystemFirmwareTable 748->766 767 a5bc4e 748->767 750->751 754 a5bf41-a5bf59 call a5cb00 751->754 755 a5c45d-a5c45f 751->755 770 a5bf87-a5bf9f call a5cb00 754->770 771 a5bf5b-a5bf75 call a5c490 754->771 755->734 760 a5c465-a5c46c UnmapViewOfFile 755->760 763 a5bf16-a5bf18 758->763 764 a5bd9b-a5bd9f 758->764 760->734 763->742 769 a5bda0-a5bda6 764->769 766->747 792 a5bcbf-a5bccd 766->792 767->747 773 a5bdb5-a5bdbe 769->773 774 a5bda8-a5bdb3 769->774 786 a5bfc5-a5bfdd call a5cb00 770->786 787 a5bfa1-a5bfc2 call a5c490 * 2 770->787 782 a5bf77 771->782 783 a5bf7f-a5bf83 771->783 779 a5bdc4-a5bdc9 773->779 780 a5bf12-a5bf14 773->780 774->769 774->773 779->780 784 a5bdcf-a5bdd1 779->784 780->742 782->770 789 a5bf79-a5bf7d 782->789 783->770 790 a5bdd3-a5bdd5 784->790 791 a5bddb-a5bde7 784->791 800 a5c003-a5c01b call a5cb00 786->800 801 a5bfdf-a5c000 call a5c490 * 2 786->801 787->786 789->770 789->783 790->780 790->791 791->780 797 a5bded-a5bdf4 791->797 795 a5bcdc-a5bcf0 792->795 796 a5bccf-a5bcd7 792->796 795->754 796->747 797->780 802 a5bdfa-a5be02 797->802 811 a5c01d-a5c031 800->811 812 a5c05c 800->812 801->800 802->780 806 a5be08-a5be10 802->806 806->780 809 a5be16-a5be25 806->809 809->780 813 a5be2b-a5be67 UnmapViewOfFile MapViewOfFile 809->813 818 a5c033 811->818 819 a5c03b-a5c059 call a5c490 * 2 811->819 816 a5c060-a5c070 call a5b780 812->816 814 a5bf0d-a5bf10 813->814 815 a5be6d-a5be8d call a65196 813->815 814->742 827 a5be9f-a5bedd call a61ee0 call a617c0 UnmapViewOfFile 815->827 828 a5be8f-a5be9a 815->828 830 a5c076-a5c0ae call a5cb00 816->830 831 a5c471-a5c476 call a59da0 816->831 818->812 823 a5c035-a5c039 818->823 819->812 823->812 823->819 827->745 828->745 845 a5c0b4-a5c0b9 830->845 846 a5c389-a5c39e 830->846 836 a5c47b-a5c485 call a59da0 831->836 847 a5c0cb-a5c0e2 call a5c490 845->847 848 a5c0bb 845->848 849 a5c3b7-a5c3bc 846->849 850 a5c3a0-a5c3b0 846->850 865 a5c1a5-a5c1b9 call a5c490 847->865 866 a5c0e8-a5c108 847->866 851 a5c0c1-a5c0c5 848->851 852 a5c352-a5c367 848->852 854 a5c3c7-a5c3dd call a5cb00 849->854 855 a5c3be 849->855 873 a5c3b4 850->873 851->847 851->852 856 a5c37d-a5c381 852->856 857 a5c369-a5c379 852->857 871 a5c3f7-a5c3fa 854->871 872 a5c3df-a5c3f4 call a5c490 854->872 861 a5c3c0-a5c3c5 855->861 862 a5c3fc 855->862 856->816 864 a5c387 856->864 857->856 861->854 869 a5c403-a5c405 861->869 867 a5c407-a5c420 call a5cb00 862->867 868 a5c3fe 862->868 864->873 888 a5c27c-a5c293 call a5c490 865->888 889 a5c1bf-a5c1df 865->889 866->836 874 a5c10e-a5c110 866->874 880 a5c45a 867->880 890 a5c422-a5c455 call a5c490 * 3 867->890 876 a5c457 868->876 877 a5c400 868->877 869->867 869->876 871->862 872->871 873->849 881 a5c116-a5c123 call a65637 874->881 882 a5c112-a5c114 874->882 876->880 877->869 880->755 886 a5c125-a5c131 881->886 882->886 886->836 894 a5c137-a5c139 886->894 888->852 904 a5c299-a5c2b6 888->904 889->836 892 a5c1e5-a5c1e7 889->892 890->880 896 a5c1ed-a5c1fa call a65637 892->896 897 a5c1e9-a5c1eb 892->897 894->836 899 a5c13f-a5c153 894->899 902 a5c1fc-a5c208 896->902 897->902 905 a5c155-a5c166 call a5c8c0 899->905 906 a5c168 899->906 902->836 909 a5c20e-a5c210 902->909 904->836 912 a5c2bc-a5c2be 904->912 910 a5c16b-a5c193 call a5cfb0 905->910 906->910 909->836 917 a5c216-a5c22a 909->917 910->836 928 a5c199-a5c1a1 910->928 913 a5c2c4-a5c2d1 call a65637 912->913 914 a5c2c0-a5c2c2 912->914 919 a5c2d3-a5c2df 913->919 914->919 922 a5c22c-a5c23d call a5c8c0 917->922 923 a5c23f 917->923 919->836 927 a5c2e5-a5c2e7 919->927 929 a5c242-a5c26a call a5cfb0 922->929 923->929 927->836 931 a5c2ed-a5c301 927->931 928->865 929->836 937 a5c270-a5c278 929->937 933 a5c316 931->933 934 a5c303-a5c314 call a5c8c0 931->934 938 a5c319-a5c343 call a5cfb0 933->938 934->938 937->888 938->836 942 a5c349-a5c34e 938->942 942->852
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetVersion.KERNEL32(08BFF329,00000000,00000000), ref: 00A5BBCD
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemFirmwareTable), ref: 00A5BC00
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00A5BC07
                                                                                                                                                                                                                                              • GetSystemFirmwareTable.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A5BC26
                                                                                                                                                                                                                                              • GetSystemFirmwareTable.KERNELBASE ref: 00A5BCB9
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,NtOpenSection), ref: 00A5BD1B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00A5BD22
                                                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(00000000,00000004,00000000,000F0000,00010000), ref: 00A5BD88
                                                                                                                                                                                                                                              • UnmapViewOfFile.KERNEL32(00000000), ref: 00A5BE31
                                                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(00000000,00000004,00000000,?,?), ref: 00A5BE5A
                                                                                                                                                                                                                                              • UnmapViewOfFile.KERNEL32(00000000), ref: 00A5BECA
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00A5BF30
                                                                                                                                                                                                                                              • UnmapViewOfFile.KERNEL32(00000000), ref: 00A5C466
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileView$HandleUnmap$AddressFirmwareModuleProcSystemTable$CloseVersion
                                                                                                                                                                                                                                              • String ID: ,$@$GetSystemFirmwareTable$NtOpenSection$W$_DMI$_SM_$kernel32.dll$ntdll.dll
                                                                                                                                                                                                                                              • API String ID: 26960555-752303837
                                                                                                                                                                                                                                              • Opcode ID: 522acdb13a894380d2caa41dcc68d201be35857c660915b9c95bf8d61ec3201a
                                                                                                                                                                                                                                              • Instruction ID: 03e6948409de9fb8a6ec9123fae9f4f52e0ed59297dde72e73231cfbac2c9e10
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 522acdb13a894380d2caa41dcc68d201be35857c660915b9c95bf8d61ec3201a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CA52B1B1E00618AFDB10CFA8CC45BAEBBB9BF48325F144119E945EB355D734AD4ACB90
                                                                                                                                                                                                                                              Function 00A541B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 132stringtimeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A541D4
                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A541ED
                                                                                                                                                                                                                                              • GetVersionExA.KERNEL32(0000009C,?,?,00989680,00000000), ref: 00A54217
                                                                                                                                                                                                                                              • GetNativeSystemInfo.KERNELBASE(?), ref: 00A5422E
                                                                                                                                                                                                                                              • wsprintfA.USER32 ref: 00A542DC
                                                                                                                                                                                                                                              • wsprintfA.USER32 ref: 00A542FF
                                                                                                                                                                                                                                              • lstrcatA.KERNEL32(?,?), ref: 00A54316
                                                                                                                                                                                                                                              • lstrlenA.KERNEL32(?), ref: 00A5436E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: SystemTimewsprintf$FileInfoNativeUnothrow_t@std@@@Version__ehfuncinfo$??2@lstrcatlstrlen
                                                                                                                                                                                                                                              • String ID: status=%08lxstatus_microstub=%08lx%08lx$AMD64$cookie=%lsedition=%ldevent=%smidex=%lsstat_session=%lsstatsSendTime=%I64dos=win,%d,%d,%d,%d,%d,%s%sexe_version=%lsSfxVersion=%ls$microstub$srv
                                                                                                                                                                                                                                              • API String ID: 2179732243-3440893326
                                                                                                                                                                                                                                              • Opcode ID: 1216f1579b9c04919661e3ac468cc9bd71a73bda9732227a4fae34d857d0bfd0
                                                                                                                                                                                                                                              • Instruction ID: 33769bbf6b9ad3c49fdcd4d485ac4963f153dbb6065ee12cd0c7848ed57cf389
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1216f1579b9c04919661e3ac468cc9bd71a73bda9732227a4fae34d857d0bfd0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8C513FB2A002289FCF60CF64CC45B9ABBB9FF48305F01C1D5EA0DA6151EB719A95EF54
                                                                                                                                                                                                                                              Function 00A5A100 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 329fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1224 a5a100-a5a148 call a5b780 1227 a5a4b7-a5a4bc call a59da0 1224->1227 1228 a5a14e-a5a1b7 GetVersion call a59ff0 CreateFileW 1224->1228 1231 a5a4c1-a5a4c6 call a59da0 1227->1231 1240 a5a1c7-a5a1db call a65196 1228->1240 1241 a5a1b9-a5a1c2 GetLastError 1228->1241 1233 a5a4cb-a5a4d0 call a59da0 1231->1233 1237 a5a4d5-a5a4da call a5cc40 1233->1237 1247 a5a1dd-a5a1e4 1240->1247 1248 a5a1e9-a5a229 call a61ee0 DeviceIoControl 1240->1248 1243 a5a46e-a5a482 call a65191 1241->1243 1252 a5a484-a5a494 1243->1252 1253 a5a498-a5a4b6 call a60bbe 1243->1253 1250 a5a465-a5a468 CloseHandle 1247->1250 1256 a5a239-a5a23e 1248->1256 1257 a5a22b-a5a234 GetLastError 1248->1257 1250->1243 1252->1253 1260 a5a244-a5a247 1256->1260 1261 a5a45e 1256->1261 1257->1250 1260->1261 1262 a5a24d-a5a252 1260->1262 1261->1250 1263 a5a258 1262->1263 1264 a5a41b-a5a420 1262->1264 1267 a5a265-a5a273 call a5b780 1263->1267 1268 a5a25a-a5a25f 1263->1268 1265 a5a422-a5a436 call a5cb70 call a5cc50 1264->1265 1266 a5a438-a5a43d 1264->1266 1265->1250 1270 a5a440-a5a445 1266->1270 1267->1231 1277 a5a279-a5a29b 1267->1277 1268->1264 1268->1267 1270->1270 1273 a5a447-a5a45c call a5cb70 call a5cc50 1270->1273 1273->1250 1277->1233 1284 a5a2a1-a5a2b0 1277->1284 1285 a5a2b2-a5a2bb call a5c8c0 1284->1285 1286 a5a2be-a5a2d7 call a5cdd0 1284->1286 1285->1286 1291 a5a2dd-a5a2eb call a65637 1286->1291 1292 a5a2d9-a5a2db 1286->1292 1291->1233 1293 a5a2f1-a5a2f4 1291->1293 1292->1293 1293->1233 1296 a5a2fa-a5a30e 1293->1296 1297 a5a314-a5a321 1296->1297 1298 a5a3e2-a5a3f3 1296->1298 1299 a5a3d7-a5a3dc 1297->1299 1300 a5a327-a5a32e 1297->1300 1301 a5a3f5-a5a40b 1298->1301 1302 a5a40e-a5a419 call a5cc50 1298->1302 1305 a5a3dd call a5cb70 1299->1305 1300->1299 1304 a5a334-a5a354 1300->1304 1301->1302 1302->1250 1311 a5a356-a5a358 1304->1311 1312 a5a362-a5a37f 1304->1312 1305->1298 1311->1312 1313 a5a35a-a5a360 1311->1313 1312->1237 1320 a5a385-a5a39e call a5cfb0 1312->1320 1314 a5a3a1-a5a3ae 1313->1314 1316 a5a3b0-a5a3c7 1314->1316 1317 a5a3ca-a5a3d5 1314->1317 1316->1317 1317->1298 1320->1314
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetVersion.KERNEL32 ref: 00A5A180
                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00A5A1A9
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00A5A1B9
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A5A468
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateErrorFileHandleLastVersion
                                                                                                                                                                                                                                              • String ID: SCSIDISK$\\.\PhysicalDrive%u$\\.\Scsi%u:
                                                                                                                                                                                                                                              • API String ID: 1515857667-131545429
                                                                                                                                                                                                                                              • Opcode ID: 15bbfb037c1d678b3f886a1799ed897943d4888c971a08920427517275b46940
                                                                                                                                                                                                                                              • Instruction ID: 9ede7ea38a9561c8f62e38fdb017565f76bab398fb9568a36c1e55d2edba28ad
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 15bbfb037c1d678b3f886a1799ed897943d4888c971a08920427517275b46940
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24C1AC75A00218DFDF04DFA8C885AADBBB5FF58311F148259EC06AB351DB71AD09CBA1
                                                                                                                                                                                                                                              Function 00A59250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CryptGenRandom.ADVAPI32(00000008,00A59209,08BFF329,?,00A59209,0000800C,?,?,00A7B144,00000000,?,?,?,?,00A72269,000000FF), ref: 00A592A8
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(Unable to generate random number!,?,00A59209,0000800C,?,?,00A7B144,00000000,?,?,?,?,00A72269,000000FF), ref: 00A59320
                                                                                                                                                                                                                                                • Part of subcall function 00A57DA0: ___std_exception_copy.LIBVCRUNTIME ref: 00A57DD8
                                                                                                                                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 00A59338
                                                                                                                                                                                                                                                • Part of subcall function 00A6203A: RaiseException.KERNEL32(?,?,00A58071,?,?,?,?,?,?,?,?,00A58071,?,00A7B144,00000000), ref: 00A6209A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CryptErrorExceptionException@8LastRaiseRandomThrow___std_exception_copy
                                                                                                                                                                                                                                              • String ID: Unable to generate random number!$la
                                                                                                                                                                                                                                              • API String ID: 4207938790-628490258
                                                                                                                                                                                                                                              • Opcode ID: 2681807d89daf6ea7e0b501a504579a799cf62e61224e02b9f059a96b55010c1
                                                                                                                                                                                                                                              • Instruction ID: 042ccf1ada6c6eac5060b080af2f076d1f91ff519bbdf68f72cdfb604aa78317
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2681807d89daf6ea7e0b501a504579a799cf62e61224e02b9f059a96b55010c1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D221C572940248EBCB54DFA4DD42FAEB778FB08714F108769FA19A72C1DB306985CB51
                                                                                                                                                                                                                                              Function 00A5B0E0 Relevance: 3.4, APIs: 2, Instructions: 449encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00A5B780: GetProcessHeap.KERNEL32(00A55644), ref: 00A5B7DC
                                                                                                                                                                                                                                                • Part of subcall function 00A58DC0: lstrcatA.KERNEL32(?, (Prototype),?,08BFF329,?), ref: 00A58E56
                                                                                                                                                                                                                                                • Part of subcall function 00A58DC0: CryptAcquireContextA.ADVAPI32(?,00000000,?,00000018,F0000040,?,08BFF329,?), ref: 00A58E6D
                                                                                                                                                                                                                                                • Part of subcall function 00A58DC0: CryptReleaseContext.ADVAPI32(00000000,00000000,?,08BFF329,?), ref: 00A58E85
                                                                                                                                                                                                                                                • Part of subcall function 00A59450: CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00A58378,0000800C,08BFF329,?), ref: 00A59470
                                                                                                                                                                                                                                                • Part of subcall function 00A59450: CryptDestroyHash.ADVAPI32(?,00000000), ref: 00A59489
                                                                                                                                                                                                                                                • Part of subcall function 00A58DC0: GetLastError.KERNEL32(Unable to acquire cryptographic provider!,?,08BFF329,?), ref: 00A58EAC
                                                                                                                                                                                                                                                • Part of subcall function 00A58DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00A58ECA
                                                                                                                                                                                                                                                • Part of subcall function 00A58DC0: CryptReleaseContext.ADVAPI32(00000000,00000000,?,00A7B144,00000000,?,08BFF329,?), ref: 00A58ED9
                                                                                                                                                                                                                                                • Part of subcall function 00A59450: GetLastError.KERNEL32(Unable to create hash context!), ref: 00A594A4
                                                                                                                                                                                                                                                • Part of subcall function 00A59450: __CxxThrowException@8.LIBVCRUNTIME ref: 00A594BC
                                                                                                                                                                                                                                                • Part of subcall function 00A5C500: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A5C5FD
                                                                                                                                                                                                                                                • Part of subcall function 00A5C500: GetLastError.KERNEL32(?,?,?,?,00A72548), ref: 00A5C607
                                                                                                                                                                                                                                                • Part of subcall function 00A59340: CryptGetHashParam.ADVAPI32(?,00000004,0000800C,00A58744,00000000,08BFF329,?,?,?,00000000), ref: 00A59395
                                                                                                                                                                                                                                                • Part of subcall function 00A59340: CryptGetHashParam.ADVAPI32(?,00000002,00000000,0000800C,00000000,0000800C,00000000,?), ref: 00A593DC
                                                                                                                                                                                                                                              • CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00008003), ref: 00A5B5EF
                                                                                                                                                                                                                                              • CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00008003), ref: 00A5B623
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Crypt$Hash$ContextDestroyErrorLast$Exception@8ParamReleaseThrow$AcquireCreateDirectoryHeapProcessSystemlstrcat
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2781682779-0
                                                                                                                                                                                                                                              • Opcode ID: bbf47508e1b28b7d5b3d84e1daa42c6eb1aa6fc1959b2455ae4edca24f091a81
                                                                                                                                                                                                                                              • Instruction ID: 56e6804f73be29e9c77a2db437a8b7895eef6870ec8fd51a57bbdba1424ab0a0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bbf47508e1b28b7d5b3d84e1daa42c6eb1aa6fc1959b2455ae4edca24f091a81
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9A128F31901268CBDB21DB64CD44BDEBBB5BF44315F1482DAD809A7382DB349E88CFA1
                                                                                                                                                                                                                                              Function 00A582F0 Relevance: 1.6, APIs: 1, Instructions: 90encryptionCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CryptDestroyHash.ADVAPI32(00000000,?,?,?,00000000,00000004,?,00A58744,0000800C,08BFF329,?), ref: 00A583CB
                                                                                                                                                                                                                                                • Part of subcall function 00A59020: CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?,08BFF329,?,?,00A58744,?,?,?,?,00A72269,000000FF), ref: 00A59088
                                                                                                                                                                                                                                                • Part of subcall function 00A59020: CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,00A72269,000000FF), ref: 00A590A4
                                                                                                                                                                                                                                                • Part of subcall function 00A59020: CryptHashData.ADVAPI32(?,?,08BFF329,00000000,?,?,?,?,00A72269,000000FF), ref: 00A590BB
                                                                                                                                                                                                                                                • Part of subcall function 00A59020: CryptGetHashParam.ADVAPI32(00000000,00000004,?,?,00000000,?,?,?,?,00A72269,000000FF), ref: 00A590E4
                                                                                                                                                                                                                                                • Part of subcall function 00A59020: CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000,?,00000000,?,?,?,?,?,00A72269,000000FF), ref: 00A59128
                                                                                                                                                                                                                                                • Part of subcall function 00A59020: CryptDestroyHash.ADVAPI32(00000000,?,?,?,?,00A72269,000000FF), ref: 00A5913E
                                                                                                                                                                                                                                                • Part of subcall function 00A59020: CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00A72269,000000FF), ref: 00A5914E
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Crypt$Hash$Destroy$Param$ContextCreateDataRelease
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2857581251-0
                                                                                                                                                                                                                                              • Opcode ID: ecdc354d26a896cabb45354b656cd9d7ab81eafb9b3766bb077d84cd9a749588
                                                                                                                                                                                                                                              • Instruction ID: c49a4ff8ac53aa38a3c3359804f4ada9ff6c7576959caf72985e54787f0ced89
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ecdc354d26a896cabb45354b656cd9d7ab81eafb9b3766bb077d84cd9a749588
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44311CB1D00209ABDB00DF94C986BEFBBB8FB54715F004159ED05B7281DB74AA49CBA0
                                                                                                                                                                                                                                              Function 00A51020 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 60libraryloadermemoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A51029
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00A51034
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A51044
                                                                                                                                                                                                                                              • SetDllDirectoryW.KERNEL32(00A735D4), ref: 00A51068
                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00A51073
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,LdrEnumerateLoadedModules), ref: 00A51083
                                                                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A510A4
                                                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00A510C0
                                                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00A510E4
                                                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00A510F0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExitProcess$AddressHandleModuleProc$DirectoryFeatureHeapInformationPresentProcessor
                                                                                                                                                                                                                                              • String ID: LdrEnumerateLoadedModules$SetDefaultDllDirectories$kernel32.dll$ntdll.dll
                                                                                                                                                                                                                                              • API String ID: 1484830609-1451921263
                                                                                                                                                                                                                                              • Opcode ID: b56437061a99df3d735ecd30d634964b66d5b21aad4fb20faaccd88506232117
                                                                                                                                                                                                                                              • Instruction ID: 7dfbed237fca6d294d81adcc596c73ae74e06d79b4c3f92b642499a58de5101a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b56437061a99df3d735ecd30d634964b66d5b21aad4fb20faaccd88506232117
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2511EF72B802127BDE20A7B1AD1FB5D69187B10B42F42C520F94DA51E1DE608ACA9A96
                                                                                                                                                                                                                                              Function 00A538C0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1001 a538c0-a538f1 CreateFileMappingW 1002 a53900-a53914 MapViewOfFile 1001->1002 1003 a538f3-a538fb GetLastError 1001->1003 1005 a53916-a5391e GetLastError 1002->1005 1006 a53920-a5392d FindResourceW 1002->1006 1004 a53996-a539b1 SetLastError call a60bbe 1003->1004 1008 a5398e-a53995 CloseHandle 1005->1008 1009 a5397f-a53985 GetLastError 1006->1009 1010 a5392f-a53939 LoadResource 1006->1010 1008->1004 1011 a53987-a53988 UnmapViewOfFile 1009->1011 1010->1009 1013 a5393b-a53953 call a60602 1010->1013 1011->1008 1013->1009 1016 a53955-a5397d wsprintfW 1013->1016 1016->1011
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CreateFileMappingW.KERNELBASE(?,00000000,01000002,00000000,00000000,00000000,?), ref: 00A538E7
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00A538F3
                                                                                                                                                                                                                                              • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?), ref: 00A5390A
                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00A53916
                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00A5398F
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 00A53997
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorLast$File$CloseCreateHandleMappingView
                                                                                                                                                                                                                                              • String ID: %d.%d.%d.%d
                                                                                                                                                                                                                                              • API String ID: 1867540158-3491811756
                                                                                                                                                                                                                                              • Opcode ID: 125cc461f409a7e9ddfd31910ae3b580658b2eb36b9460721cb8cf6a65d9761b
                                                                                                                                                                                                                                              • Instruction ID: 707018839a4818a7afdd9d487f786a9590f7bc96218af9305bc200acd6a7202b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 125cc461f409a7e9ddfd31910ae3b580658b2eb36b9460721cb8cf6a65d9761b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B621A772600214FBDF209BA58C59FBBBB7CFF45791F118159FD4AD6280DAB08A42D760
                                                                                                                                                                                                                                              Function 00A53190 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1017 a53190-a531b9 GetWindowsDirectoryW 1018 a53240-a53246 GetLastError 1017->1018 1019 a531bf-a531c2 1017->1019 1020 a53248-a5324d 1018->1020 1019->1018 1021 a531c4-a531e1 call a59250 ConvertStringSecurityDescriptorToSecurityDescriptorA 1019->1021 1022 a53256-a53272 SetLastError call a60bbe 1020->1022 1023 a5324f-a53250 LocalFree 1020->1023 1021->1018 1027 a531e3-a53217 wsprintfW CreateDirectoryW 1021->1027 1023->1022 1027->1020 1029 a53219-a5323e wsprintfW CreateDirectoryW 1027->1029 1029->1018 1029->1020
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetWindowsDirectoryW.KERNEL32(?,00000020,?,?,?), ref: 00A531B1
                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(D:P(A;CIOI;FA;;;SY)(A;CIOI;FA;;;BA)(A;CIOI;FRFX;;;BU),00000001,?,00000000), ref: 00A531DA
                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00A53201
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,?), ref: 00A5320F
                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00A53228
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(?,?), ref: 00A53236
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?), ref: 00A53240
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?), ref: 00A53250
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,?), ref: 00A53257
                                                                                                                                                                                                                                                • Part of subcall function 00A59250: CryptGenRandom.ADVAPI32(00000008,00A59209,08BFF329,?,00A59209,0000800C,?,?,00A7B144,00000000,?,?,?,?,00A72269,000000FF), ref: 00A592A8
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • %c:\asw.%08x%08x, xrefs: 00A53222
                                                                                                                                                                                                                                              • D:P(A;CIOI;FA;;;SY)(A;CIOI;FA;;;BA)(A;CIOI;FRFX;;;BU), xrefs: 00A531D5
                                                                                                                                                                                                                                              • %s\Temp\asw.%08x%08x, xrefs: 00A531F1
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Directory$CreateDescriptorErrorLastSecuritywsprintf$ConvertCryptFreeLocalRandomStringWindows
                                                                                                                                                                                                                                              • String ID: %c:\asw.%08x%08x$%s\Temp\asw.%08x%08x$D:P(A;CIOI;FA;;;SY)(A;CIOI;FA;;;BA)(A;CIOI;FRFX;;;BU)
                                                                                                                                                                                                                                              • API String ID: 1345463893-1526440225
                                                                                                                                                                                                                                              • Opcode ID: 7bb40f890fb5fd21f43a2d633e8724f20ed1d66454b1631003c1471a6c864452
                                                                                                                                                                                                                                              • Instruction ID: 7d532cfbc9d73f1eadfba494028e7b05a69bd11670482a6b28254dff5654a976
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7bb40f890fb5fd21f43a2d633e8724f20ed1d66454b1631003c1471a6c864452
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F12130B2A00218BBDF10DFE49D45DEEBBBCEF55B42F058115F909E6140D7309E8A9BA1
                                                                                                                                                                                                                                              Function 00A52BA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 319fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1343 a52ba0-a52e4c 1345 a52e52-a52e64 call a65056 1343->1345 1346 a5314e-a5316e call a60bbe 1343->1346 1345->1346 1351 a52e6a-a52e7d 1345->1351 1352 a52e80-a52e89 1351->1352 1352->1352 1353 a52e8b-a52e92 1352->1353 1354 a52e94-a52eb1 call a62460 1353->1354 1355 a52eb3-a52eb9 1353->1355 1364 a52f19-a52f2b 1354->1364 1357 a53171 call a53bf0 1355->1357 1358 a52ebf-a52eca 1355->1358 1363 a53176 call a53bf0 1357->1363 1361 a52ed3-a52eda 1358->1361 1362 a52ecc-a52ed1 1358->1362 1365 a52edd-a52f16 call a53c20 call a617c0 1361->1365 1362->1365 1373 a5317b-a53180 call a64650 1363->1373 1367 a52f2d-a52f43 1364->1367 1368 a52f48-a52f54 1364->1368 1365->1364 1371 a53011-a5301c 1367->1371 1368->1363 1372 a52f5a-a52f62 1368->1372 1378 a53020-a53029 1371->1378 1375 a52f64-a52f66 1372->1375 1376 a52f68-a52f70 1372->1376 1380 a52f80-a52faa call a53c20 1375->1380 1381 a52f72-a52f77 1376->1381 1382 a52f79-a52f7d 1376->1382 1378->1378 1384 a5302b-a5307c call a53e50 * 2 1378->1384 1390 a52ff7-a53007 call a617c0 1380->1390 1391 a52fac-a52fd3 call a617c0 1380->1391 1381->1380 1382->1380 1396 a5307e 1384->1396 1397 a53099-a530ad FindResourceW 1384->1397 1404 a5300e 1390->1404 1399 a52fd5-a52fe3 1391->1399 1400 a52feb-a52ff5 call a60bff 1391->1400 1401 a53080-a53097 call a65043 1396->1401 1402 a530af-a530cd LoadResource SizeofResource 1397->1402 1403 a53118-a5311e 1397->1403 1399->1373 1405 a52fe9 1399->1405 1400->1404 1401->1397 1402->1403 1408 a530cf-a530d1 1402->1408 1403->1346 1409 a53120-a53132 1403->1409 1404->1371 1405->1400 1408->1403 1412 a530d3-a530f9 CreateFileW 1408->1412 1413 a53144-a5314b call a60bff 1409->1413 1414 a53134-a53142 1409->1414 1412->1403 1415 a530fb-a53112 WriteFile CloseHandle 1412->1415 1413->1346 1414->1373 1414->1413 1415->1403
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FindResourceW.KERNEL32(00A50000,?,0000000A,.edat,00000005,?,?,?,?,00000000,?,?,00000000), ref: 00A530A3
                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00A50000,00000000,?,?,00000000,?,?,00000000), ref: 00A530B5
                                                                                                                                                                                                                                              • SizeofResource.KERNEL32(00A50000,00000000,?,?,00000000,?,?,00000000), ref: 00A530C3
                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE(?,00000004,00000001,00000000,00000002,00000080,00000000,?,?,00000000,?,?,00000000), ref: 00A530EE
                                                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000), ref: 00A5310B
                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,00000000,?,?,00000000), ref: 00A53112
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Resource$File$CloseCreateFindHandleLoadSizeofWrite
                                                                                                                                                                                                                                              • String ID: .edat$EDAT_
                                                                                                                                                                                                                                              • API String ID: 2436039785-3242799629
                                                                                                                                                                                                                                              • Opcode ID: 1088efb9a0419288d52a0c2b7ffbc72b5ede1904a0883cdc0f447ef9a85d03ed
                                                                                                                                                                                                                                              • Instruction ID: b17e73f994d044d66dc337c56a32f299a346c28e956d51ec4466b7c2856f9632
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1088efb9a0419288d52a0c2b7ffbc72b5ede1904a0883cdc0f447ef9a85d03ed
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1CA1C872E002059BCF14DFB8DC95BAEB7B5FF88741F158229ED16A7281DB305A49CB90
                                                                                                                                                                                                                                              Function 00A54020 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 81stringCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1418 a54020-a5403d 1419 a54057-a5405b 1418->1419 1420 a5403f-a54055 wsprintfA 1418->1420 1421 a54077-a5408d wsprintfA 1419->1421 1422 a5405d-a54075 wsprintfA 1419->1422 1423 a54090-a5413f call a53b30 wsprintfA lstrlenA call a527b0 1420->1423 1421->1423 1422->1423 1427 a54144-a5415f call a60bbe 1423->1427
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • &t=screenview&cd=%s, xrefs: 00A54046
                                                                                                                                                                                                                                              • &t=event&ec=microstub&ea=ok&el=%08lx, xrefs: 00A54066
                                                                                                                                                                                                                                              • &t=event&ec=microstub&ea=error&el=%08lx%08lx, xrefs: 00A54081
                                                                                                                                                                                                                                              • v=1&tid=%ls&cid=%ls&aiid=%ls&an=Free&cd3=Online%s, xrefs: 00A540B0
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: wsprintf$lstrlen
                                                                                                                                                                                                                                              • String ID: &t=event&ec=microstub&ea=error&el=%08lx%08lx$&t=event&ec=microstub&ea=ok&el=%08lx$&t=screenview&cd=%s$v=1&tid=%ls&cid=%ls&aiid=%ls&an=Free&cd3=Online%s
                                                                                                                                                                                                                                              • API String ID: 217384638-4207265834
                                                                                                                                                                                                                                              • Opcode ID: 99fe32ffb15ed71ebbe2330a4ee6dd8fadbd1bf3edf18ff490ab68b7b9fc55f0
                                                                                                                                                                                                                                              • Instruction ID: 5c7483e0a5f980691309bb2f6fbf0c9a399eca7a2ed20fe4ffe2c6beff04e813
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99fe32ffb15ed71ebbe2330a4ee6dd8fadbd1bf3edf18ff490ab68b7b9fc55f0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 48315EB2900219ABCF20DF64DC05B9AB7B8FF18315F0181D9A64DE3241EB749A94DF95
                                                                                                                                                                                                                                              Function 00A539C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FindResourceW.KERNEL32(00A50000,00000001,00000010), ref: 00A539F1
                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00A50000,00000000), ref: 00A53A01
                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00A53A52
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • %d.%d.%d.%d, xrefs: 00A53A4A
                                                                                                                                                                                                                                              • \StringFileInfo\040904b0\Edition, xrefs: 00A53A67
                                                                                                                                                                                                                                              • \StringFileInfo\040904b0\SubEdition, xrefs: 00A53A8F
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Resource$FindLoadwsprintf
                                                                                                                                                                                                                                              • String ID: %d.%d.%d.%d$\StringFileInfo\040904b0\Edition$\StringFileInfo\040904b0\SubEdition
                                                                                                                                                                                                                                              • API String ID: 1667977947-3794282237
                                                                                                                                                                                                                                              • Opcode ID: d37d6209aaae561831b08e87ac91479f2b66405a1fa1298dd1a05fd0437f4d3d
                                                                                                                                                                                                                                              • Instruction ID: b82341d3bf86d6e63d8d57ff813f1d2522ec6465c82448e1caeaf2c8b0d215b8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d37d6209aaae561831b08e87ac91479f2b66405a1fa1298dd1a05fd0437f4d3d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44318B72A00219ABDF10DF95CD41ABFB3B8FF48741F044069FE09E6241EA729E4597A1
                                                                                                                                                                                                                                              Function 00A58130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • LoadLibraryA.KERNELBASE(wintrust.dll,?,?,00A7B144,00000000), ref: 00A58136
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 00A58149
                                                                                                                                                                                                                                              • FreeLibrary.KERNELBASE(00000000,?,?,00A7B144,00000000), ref: 00A58152
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                                                                                              • String ID: CryptCATAdminAcquireContext2$wintrust.dll
                                                                                                                                                                                                                                              • API String ID: 145871493-3385133079
                                                                                                                                                                                                                                              • Opcode ID: 841c9c1dd013b3ff9733b71051f2f0ba915b5f53600f6f807d821ae9a9d1501d
                                                                                                                                                                                                                                              • Instruction ID: e4d2f38655cdca2c4aa004b5c8b490fce7928da222a3ac9a70e2e6c3c1f120e1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 841c9c1dd013b3ff9733b71051f2f0ba915b5f53600f6f807d821ae9a9d1501d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CCD05E33600A21774E1017F97C0D9CBAB64BDC6E6234BC769F80DA61188B648CC3B2A1
                                                                                                                                                                                                                                              Function 00A5B890 Relevance: 6.2, APIs: 4, Instructions: 243COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000003,00000000,00000010,000000FF,00000000,00000000,?,00A5B45F), ref: 00A5B99D
                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000010,00000000,?,00A5B45F), ref: 00A5B9D6
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000003,00000000,00000010,000000FF,00000000,00000000,00000000,00000000,?,00A5B45F), ref: 00A5BA89
                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000003,00000000,00000010,000000FF,00A5B45F,00000000,00000000,00000000,?,00A5B45F), ref: 00A5BAC7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 626452242-0
                                                                                                                                                                                                                                              • Opcode ID: aa17ea98e94dce6692ffb62cb10654ef6bba5048c433227b10225023e18deb45
                                                                                                                                                                                                                                              • Instruction ID: db992e700aea2efedc5b17454915aed868568b8aa44d0644c3a125ee250fbbc4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa17ea98e94dce6692ffb62cb10654ef6bba5048c433227b10225023e18deb45
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C91A031A10205DFDB11CF68CC84BADBBB5FF85316F248159ED15AB391DB71AA06CBA0
                                                                                                                                                                                                                                              Function 00A5F080 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,00A5FCDE,?,?,?,?,?,00000000), ref: 00A5F0A3
                                                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00A5FCDE,?,?,?,?,?,00000000), ref: 00A5F0AA
                                                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,00A5FCDE,?,?,?,?,?,00000000), ref: 00A5F0E2
                                                                                                                                                                                                                                              • HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 00A5F0E9
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Heap$Process$AllocateFree
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 576844849-0
                                                                                                                                                                                                                                              • Opcode ID: c9232383d83f32436f0414fd8b4273886ddf5f40abeec40c3873802ef8252344
                                                                                                                                                                                                                                              • Instruction ID: 34c37ff8cc12209389a4194e9bb91dae94c93b62093581e5a1bc3d62fe5f7a7b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c9232383d83f32436f0414fd8b4273886ddf5f40abeec40c3873802ef8252344
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2B019272604605AFEB20EF99EC45A27B7ACFB40721B04C52AF91EC6661E731E945CB60
                                                                                                                                                                                                                                              Function 00A58880 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 315COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 00A58C7A
                                                                                                                                                                                                                                                • Part of subcall function 00A5FC70: GetProcessHeap.KERNEL32(00000000,?,?,?,?,00000000), ref: 00A5FCB3
                                                                                                                                                                                                                                                • Part of subcall function 00A5FC70: HeapFree.KERNEL32(00000000), ref: 00A5FCBA
                                                                                                                                                                                                                                                • Part of subcall function 00A5ED90: GetProcessHeap.KERNEL32(00000000,8B55CCCC,00A582E6,?,00A58A31,?,?,?), ref: 00A5EDB7
                                                                                                                                                                                                                                                • Part of subcall function 00A5ED90: HeapFree.KERNEL32(00000000,?,?), ref: 00A5EDBE
                                                                                                                                                                                                                                                • Part of subcall function 00A5FAC0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,-00000002), ref: 00A5FC26
                                                                                                                                                                                                                                                • Part of subcall function 00A5FAC0: HeapFree.KERNEL32(00000000,?,?,?,-00000002), ref: 00A5FC2D
                                                                                                                                                                                                                                                • Part of subcall function 00A5FAC0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,-00000002), ref: 00A5FC4D
                                                                                                                                                                                                                                                • Part of subcall function 00A5FAC0: HeapFree.KERNEL32(00000000,?,?,?,-00000002), ref: 00A5FC54
                                                                                                                                                                                                                                                • Part of subcall function 00A5E450: GetProcessHeap.KERNEL32(00000000,00000001), ref: 00A5EC60
                                                                                                                                                                                                                                                • Part of subcall function 00A5E450: HeapFree.KERNEL32(00000000), ref: 00A5EC67
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • Unable to initialize DSA parameters!, xrefs: 00A58C50
                                                                                                                                                                                                                                              • Unable to read digest or signature!, xrefs: 00A58C47
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Heap$FreeProcess$Exception@8Throw
                                                                                                                                                                                                                                              • String ID: Unable to initialize DSA parameters!$Unable to read digest or signature!
                                                                                                                                                                                                                                              • API String ID: 786774151-2226104879
                                                                                                                                                                                                                                              • Opcode ID: ca02c78e376dea330e6dfd27997cc6f6795dc60eff8dc4130fb29a425cc9d146
                                                                                                                                                                                                                                              • Instruction ID: b87fb9be2b177254ac919f9e68eac82afa2a06eaa29b912b822ca6d62e0426a9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ca02c78e376dea330e6dfd27997cc6f6795dc60eff8dc4130fb29a425cc9d146
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BCB1CAB2D0021CAADF50DBA4DD45FDEB3BCBB18305F4445A6E909E7141EB34EA88CB61
                                                                                                                                                                                                                                              Function 00A543E0 Relevance: 3.0, APIs: 2, Instructions: 29threadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CreateThread.KERNELBASE(00000000,00000000,Function_00004020,?,00000000,?), ref: 00A5440A
                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 00A54415
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateHandleThread
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3032276028-0
                                                                                                                                                                                                                                              • Opcode ID: e7e295b015189990973f35f8a76e973e44d7844b34afecdd2ed9640739503722
                                                                                                                                                                                                                                              • Instruction ID: 5b833478b7b126234fbebea68812491e0fb6901540da712a7352f6c44309ce62
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e7e295b015189990973f35f8a76e973e44d7844b34afecdd2ed9640739503722
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9CF03771640208BFDB10DFE4DC49B6E77B4FB08706F508098F90A961D1DB746ACAC751
                                                                                                                                                                                                                                              Function 00A6A272 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00A68B5A,00000001,00000364,?,00A62AA0,?,?,?,?,?,00A57DDD,?), ref: 00A6A2B3
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000006.00000002.3659610360.0000000000A51000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A50000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659484387.0000000000A50000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3659933566.0000000000A73000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660090762.0000000000A7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000006.00000002.3660252500.0000000000A81000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_6_2_a50000_avg_antivirus_free_setup.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                                                                              • Opcode ID: 3554c0eee639ea705a01c8f8db9f086150cca1bff223838ce46b10e8dd050d01
                                                                                                                                                                                                                                              • Instruction ID: d0c8bdcb93f2cf7b4374f08b1298ad1d897aedc32dc74c7b3bca0006c017035d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3554c0eee639ea705a01c8f8db9f086150cca1bff223838ce46b10e8dd050d01
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A0F0E93269452167DB21AB769C11BDB3779AF61B70B14C121FC08F61B4DA32DD018AE2